CVE-2026-23391 - Vulnerability Details

- netfilter: xt_CT: drop pending enqueued packets on template removal

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_CT: drop pending enqueued packets on template removal

Templates refer to objects that can go away while packets are sitting in
nfqueue refer to:

- helper, this can be an issue on module removal.
- timeout policy, nfnetlink_cttimeout might remove it.

The use of templates with zone and event cache filter are safe, since
this just copies values.

Flush these enqueued packets in case the template rule gets removed.

Published: 2026-03-25

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel’s netfilter xt_CT module, templates used by zone and event cache filters can be removed while packets are queued. This causes pending enqueued packets to be dropped, which can result in significant packet loss and may lead to denial of service. The weakness is a resource management flaw, classified as CWE–911.

Affected Systems

Affected systems include all Linux kernel distributions that use the netfilter xt_CT module. Vendor information lists Linux:Linux, and no specific version numbers are provided in the official data.

Risk and Exploitability

The vulnerability carries a CVSS score of 7.8, indicating moderate to high severity. The EPSS score is less than 1 %, suggesting a low likelihood of exploitation, and it is not listed in the CISA KEV catalog. Exploitation would require the ability to manipulate the kernel’s netfilter templates—such as by unloading helper modules or triggering nfnetlink_cttimeout to remove them—while traffic is being processed, which implies privileged access to the operating system.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< 55445134d42b84cb0a272e42c98d233ca65eca83
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< cc57506dd66555899560b9c0f24e813f034e12ec
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< d2d0bae0c9a2a17b6990a2966f5cdce0813d6256
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< 63b8097cea1923fe82cd598068d0796da8c015ec
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< 19a230dec6bb8928e3f96387f9085cf2c79bcef9
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< cb549925875fa06dd155e49db4ac2c5044c30f9c
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< 777d02efe3d630cca4c1b63962cec17c57711325
`24de58f465165298aaa8f286b2592f0163706cfe`	affected	< f62a218a946b19bb59abdd5361da85fa4606b96b

Linux

affected

Version	Status	Constraints
`3.4`	affected	—
`0`	unaffected	< 3.4
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.167`	unaffected	≤ 6.1.*
`6.6.130`	unaffected	≤ 6.6.*
`6.12.78`	unaffected	≤ 6.12.*
`6.18.20`	unaffected	≤ 6.18.*
`6.19.10`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[24de58f465165298aaa8f286b2592f0163706cfe,d2d0bae0c9a2a17b6990a2966f5cdce0813d6256)`	affected	code_commit	—
`[24de58f465165298aaa8f286b2592f0163706cfe,63b8097cea1923fe82cd598068d0796da8c015ec)`	affected	code_commit	—
`[24de58f465165298aaa8f286b2592f0163706cfe,19a230dec6bb8928e3f96387f9085cf2c79bcef9)`	affected	code_commit	—
`[24de58f465165298aaa8f286b2592f0163706cfe,cb549925875fa06dd155e49db4ac2c5044c30f9c)`	affected	code_commit	—
`[24de58f465165298aaa8f286b2592f0163706cfe,777d02efe3d630cca4c1b63962cec17c57711325)`	affected	code_commit	—
`[24de58f465165298aaa8f286b2592f0163706cfe,f62a218a946b19bb59abdd5361da85fa4606b96b)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.4`	affected	generic	—
`[0,3.4)`	unaffected	generic	—
`[6.1.167,6.2.0)`	unaffected	semver	—
`[6.6.130,6.7.0)`	unaffected	semver	—
`[6.12.78,6.13.0)`	unaffected	semver	—
`[6.18.20,6.19.0)`	unaffected	semver	—
`[6.19.10,6.20.0)`	unaffected	semver	—
`[7.0-rc5,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a patched release that incorporates the xt_CT module fix.
Verify that no helper modules or nfnetlink_cttimeout operations are removing netfilter templates while traffic is active.
Monitor system logs for netfilter packet drop events that may indicate improper template removal.

Generated by OpenCVE AI on April 2, 2026 at 16:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/19a230dec6bb8928e3f96387f9085cf2c79bcef9
https://git.kernel.org/stable/c/55445134d42b84cb0a272e42c98d233ca65eca83
https://git.kernel.org/stable/c/63b8097cea1923fe82cd598068d0796da8c015ec
https://git.kernel.org/stable/c/777d02efe3d630cca4c1b63962cec17c57711325
https://git.kernel.org/stable/c/cb549925875fa06dd155e49db4ac2c5044c30f9c
https://git.kernel.org/stable/c/cc57506dd66555899560b9c0f24e813f034e12ec
https://git.kernel.org/stable/c/d2d0bae0c9a2a17b6990a2966f5cdce0813d6256
https://git.kernel.org/stable/c/f62a218a946b19bb59abdd5361da85fa4606b96b
https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-23391-bb43@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-23391
https://www.cve.org/CVERecord?id=CVE-2026-23391

History

Sat, 18 Apr 2026 09:15:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/55445134d42b84cb0a272e42c98d233ca65eca83 https://git.kernel.org/stable/c/cc57506dd66555899560b9c0f24e813f034e12ec

Thu, 02 Apr 2026 15:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 26 Mar 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-911
References		https://lore.kernel.org/linux-cve-announce/2026032548-CVE-2026-23391-bb43@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-23391 https://www.cve.org/CVERecord?id=CVE-2026-23391
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Wed, 25 Mar 2026 10:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_CT: drop pending enqueued packets on template removal Templates refer to objects that can go away while packets are sitting in nfqueue refer to: - helper, this can be an issue on module removal. - timeout policy, nfnetlink_cttimeout might remove it. The use of templates with zone and event cache filter are safe, since this just copies values. Flush these enqueued packets in case the template rule gets removed.
Title		netfilter: xt_CT: drop pending enqueued packets on template removal
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/19a230dec6bb8928e3f96387f9085cf2c79bcef9 https://git.kernel.org/stable/c/63b8097cea1923fe82cd598068d0796da8c015ec https://git.kernel.org/stable/c/777d02efe3d630cca4c1b63962cec17c57711325 https://git.kernel.org/stable/c/cb549925875fa06dd155e49db4ac2c5044c30f9c https://git.kernel.org/stable/c/d2d0bae0c9a2a17b6990a2966f5cdce0813d6256 https://git.kernel.org/stable/c/f62a218a946b19bb59abdd5361da85fa4606b96b

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-03-25T10:33:15.677Z

Updated: 2026-04-18T08:58:26.823Z

Reserved: 2026-01-13T15:37:46.009Z

Link: CVE-2026-23391

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-03-25T11:16:39.707

Modified: 2026-04-18T09:16:23.143

Link: CVE-2026-23391

Redhat

Severity : Moderate

Publid Date: 2026-03-25T00:00:00Z

Links: CVE-2026-23391 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-02T20:22:59Z

Weaknesses

CWE-911

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object