Log in Start free

Vulnerability · Published Mar 25, 2026 · Assigned by Linux

CVE-2026-23351netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

High 7.8

In plain English

A high-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 97.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. Expired elements are still exposed to both the packet path and userspace dumpers via the live copy of the data structure. call_rcu() does not protect us: dump operations or element lookups starting after call_rcu has fired can still observe the free'd element, unless the commit phase has made enough progress to swap the clone and live pointers before any new reader has picked up the old version. This a similar approach as done recently for the rbtree backend in commit 35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.170-1DEBIAN-CVE-2026-23351
Debian:13linux6.12.85-1DEBIAN-CVE-2026-23351
Debian:14linux6.19.8-1DEBIAN-CVE-2026-23351
Ubuntu:22.04:LTSlinux5.15.0-179.189USN-8279-1
Ubuntu:22.04:LTSlinux5.15.0-179.189UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux6.8.0-117.117UBUNTU-CVE-2026-23351
Ubuntu:25.10linux6.17.0-29.29UBUNTU-CVE-2026-23351
Ubuntu:25.10linux6.17.0-29.29USN-8277-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-aws5.15.0-1108.115UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-aws5.15.0-1108.115USN-8279-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1055.58UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-aws6.17.0-1015.15USN-8277-1
Ubuntu:25.10linux-aws6.17.0-1015.15UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1017.17~24.04.1UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1017.17~24.04.1USN-8374-1
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1057.60~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure5.15.0-1114.123USN-8426-2
Ubuntu:22.04:LTSlinux-azure5.15.0-1114.123UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure6.8.0-1056.62UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-azure6.17.0-1015.15UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-azure6.17.0-1015.15USN-8310-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1015.15~24.04.1USN-8310-1
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1015.15~24.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1059.65~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1114.123UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1058.65UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1058.65~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-gcp5.15.0-1108.117UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-gcp5.15.0-1108.117USN-8279-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1058.61UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-gcp6.17.0-1018.19UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-gcp6.17.0-1018.19USN-8374-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1018.19~24.04.1UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1018.19~24.04.1USN-8374-1
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1060.63~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-gke5.15.0-1104.110UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-gke5.15.0-1104.110USN-8279-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1054.60UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1091.99USN-8279-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1091.99UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1041.44UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-29.29~24.04.1USN-8277-1
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-29.29~24.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-124.124~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-ibm5.15.0-1102.105USN-8279-1
Ubuntu:22.04:LTSlinux-ibm5.15.0-1102.105UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-ibm6.8.0-1055.56UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1055.56~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1103.109USN-8279-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1103.109UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-kvm5.15.0-1100.105USN-8279-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1100.105UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-178.188UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-178.188USN-8291-3
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-117.117.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-117.117.1~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1103.104USN-8279-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1103.104UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1054.57UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1026.26USN-8508-1
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1026.26UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1054.57~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1054.57.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1060.60USN-8279-1
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1060.60UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1024.24UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1049.49USN-8279-3
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1049.49UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1023.23UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1023.23USN-8277-1
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-oracle5.15.0-1105.111USN-8279-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1105.111UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oracle6.8.0-1054.55UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-oracle6.17.0-1014.14USN-8277-1
Ubuntu:25.10linux-oracle6.17.0-1014.14UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1014.14~24.04.1USN-8277-2
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1014.14~24.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1054.55~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-raspi5.15.0-1102.105UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-raspi5.15.0-1102.105USN-8279-1
Ubuntu:24.04:LTSlinux-raspi6.8.0-1056.60UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-raspi6.17.0-1017.17USN-8277-1
Ubuntu:25.10linux-raspi6.17.0-1017.17UBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-23351
Ubuntu:25.10linux-realtime6.17.0-1013.15UBUNTU-CVE-2026-23351
Ubuntu:25.10linux-realtime6.17.0-1013.15USN-8277-1
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-23351
Ubuntu:25.10linux-riscv6.17.0-29.29.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-riscv-6.176.17.0-29.29.1~24.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-117.117~22.04.1UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-23351
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1032.33UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1074.78UBUNTU-CVE-2026-23351
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1074.78USN-8528-1

Affected products (as reported)

VendorProductVersions
Linux Linux 3c4287f62044a90e73a561aa05fc46e62da173da – before 65ca51b9fb85477ab92a04295aed34b38f7c062e3c4287f62044a90e73a561aa05fc46e62da173da – before c0f1f85097ac2b6e7d750fe4d05807985cd3fd3a3c4287f62044a90e73a561aa05fc46e62da173da – before 16f3595c0441d87dfa005c47d8f95be213afaa9e3c4287f62044a90e73a561aa05fc46e62da173da – before 7864c667aed01a58b87ca518a631322cd0ac34c03c4287f62044a90e73a561aa05fc46e62da173da – before c12d570d71920903a1a0468b7d13b085203d0c933c4287f62044a90e73a561aa05fc46e62da173da – before 500a50a301ce962b019ab95053ac70264fec2c213c4287f62044a90e73a561aa05fc46e62da173da – before aff13667708dfa0dce136b8efd81baa9fa6ef2613c4287f62044a90e73a561aa05fc46e62da173da – before 9df95785d3d8302f7c066050117b04cd3c2048c2
Linux Linux 5.6

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References