CVE-2026-23399 — Missing Release of Resource after Effective Lifetime in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.0%
top 93.81%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 28
Description
In the Linux kernel, the following vulnerability has been resolved:
nf_tables: nft_dynset: fix possible stateful expression memleak in error path
If cloning the second stateful expression in the element via GFP_ATOMIC
fails, then the first stateful expression remains in place without being
released.
unreferenced object (percpu) 0x607b97e9cab8 (size 16):
comm "softirq", pid 0, jiffies 4294931867
hex dump (first 16 bytes on cpu 3):
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
backtrace (crc …
Affected Packages5 packages
▶CVEListV5linux/linux563125a73ac30d7036ae69ca35c40500562c1de4 — d1354873cbe3b344899c4311ac05897fd83e3f21+4
🔴Vulnerability Details
3OSV▶
CVE-2026-23399: In the Linux kernel, the following vulnerability has been resolved: nf_tables: nft_dynset: fix possible stateful expression memleak in error path If c↗2026-03-28
GHSA▶
GHSA-vfh6-r892-92wv: In the Linux kernel, the following vulnerability has been resolved:
nf_tables: nft_dynset: fix possible stateful expression memleak in error path
If↗2026-03-28
📋Vendor Advisories
3Red Hat
▶
Debian▶
CVE-2026-23399: linux - In the Linux kernel, the following vulnerability has been resolved: nf_tables: ...↗2026