CVE-2026-74565 - Vulnerability Details

- netfilter: nf_tables: make nft_object rhltable per table

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: make nft_object rhltable per table

The nft_object rhltable is global, this allows for accessing objects
that are being dismangled from lookup path by other existing netns.
Given the nft_obj_destroy() releases the object inmediately, this might
lead to use-after-free of these objects that are being released.
Make the existing rhltable per table to address this issue to deal with
with the nft_rcv_nl_event() path too.

Update nft_obj_lookup() to take the table as non-const, otherwise,
compiler complains when passing the objname_ht to rhltable_lookup().

Published: 2026-08-15

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel contains a use‑after‑free flaw in the nf_tables implementation. The global rhltable used to store nft_object entries is shared across network namespaces. When an object is destroyed the rhltable can still be accessed by other namespaces, allowing a use‑after‑free that may corrupt kernel memory or cause a crash.

Affected Systems

Any Linux kernel in which nf_tables is built with the global rhltable implementation is potentially vulnerable. The specific version ranges are not listed in the data, so all distributions running a kernel prior to the patch that makes rhltable per table could be affected.

Risk and Exploitability

The CVSS score is 7.8, reflecting the high impact of a kernel memory corruption bug. The EPSS score is below 1% and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of current exploitation. The flaw requires manipulation of nf_tables objects, which typically demands privileged or local access. No publicly available exploit is known at this time.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`4d44175aa5bb5f68772b1eb0306554812294ca52`	affected	< 1948e4f85b855618b5b9a27265f98d816f4cb7cb
`4d44175aa5bb5f68772b1eb0306554812294ca52`	affected	< 63ba12b664a2cd3220ed43e22c717715f4cc2ae8
`4d44175aa5bb5f68772b1eb0306554812294ca52`	affected	< 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af
`4d44175aa5bb5f68772b1eb0306554812294ca52`	affected	< f4f699790590bd0896c48a71e9232a65198f92f0

Linux

affected

Version	Status	Constraints
`5.1`	affected	—
`0`	unaffected	< 5.1
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[4d44175aa5bb5f68772b1eb0306554812294ca52,1948e4f85b855618b5b9a27265f98d816f4cb7cb)`	affected	code_commit	—
`[4d44175aa5bb5f68772b1eb0306554812294ca52,63ba12b664a2cd3220ed43e22c717715f4cc2ae8)`	affected	code_commit	—
`[4d44175aa5bb5f68772b1eb0306554812294ca52,7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af)`	affected	code_commit	—
`[4d44175aa5bb5f68772b1eb0306554812294ca52,f4f699790590bd0896c48a71e9232a65198f92f0)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.1`	affected	generic	—
`[0,5.1)`	unaffected	generic	—
`[6.12.103,6.13.0)`	unaffected	semver	—
`[6.18.44,6.19.0)`	unaffected	semver	—
`[7.1.8,7.2.0)`	unaffected	semver	—
`[7.2-rc6,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel version that includes the nf_tables rhltable‑per‑table fix, such as the latest stable release or a backported security update.
If an immediate kernel upgrade is not possible, consider disabling nf_tables support or restricting nftables management to trusted users.
Enable kernel hardening features, such as KASAN or lock‑down mode, to detect or mitigate future use‑after‑free bugs.

Generated by OpenCVE AI on August 18, 2026 at 02:55 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00116.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1948e4f85b855618b5b9a27265f98d816f4cb7cb
https://git.kernel.org/stable/c/63ba12b664a2cd3220ed43e22c717715f4cc2ae8
https://git.kernel.org/stable/c/7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af
https://git.kernel.org/stable/c/f4f699790590bd0896c48a71e9232a65198f92f0
https://lore.kernel.org/linux-cve-announce/2026081553-CVE-2026-74565-74d6@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74565
https://www.cve.org/CVERecord?id=CVE-2026-74565

History

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026081553-CVE-2026-74565-74d6@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74565 https://www.cve.org/CVERecord?id=CVE-2026-74565
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 17 Aug 2026 14:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Mon, 17 Aug 2026 12:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 17 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 15 Aug 2026 15:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 15 Aug 2026 12:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: make nft_object rhltable per table The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too. Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().
Title		netfilter: nf_tables: make nft_object rhltable per table
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1948e4f85b855618b5b9a27265f98d816f4cb7cb https://git.kernel.org/stable/c/63ba12b664a2cd3220ed43e22c717715f4cc2ae8 https://git.kernel.org/stable/c/7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af https://git.kernel.org/stable/c/f4f699790590bd0896c48a71e9232a65198f92f0

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T12:28:07.015Z

Updated: 2026-08-17T05:48:45.246Z

Reserved: 2026-08-15T05:44:03.916Z

Link: CVE-2026-74565

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T13:18:02.013

Modified: 2026-08-17T06:19:54.657

Link: CVE-2026-74565

Redhat

Severity : Moderate

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-74565 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T03:00:09Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object