Lin-Kernel Netfilter nft_object UAF via global rhltable
CVE-2026-74565 Published on August 15, 2026
netfilter: nf_tables: make nft_object rhltable per table
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: make nft_object rhltable per table
The nft_object rhltable is global, this allows for accessing objects
that are being dismangled from lookup path by other existing netns.
Given the nft_obj_destroy() releases the object inmediately, this might
lead to use-after-free of these objects that are being released.
Make the existing rhltable per table to address this issue to deal with
with the nft_rcv_nl_event() path too.
Update nft_obj_lookup() to take the table as non-const, otherwise,
compiler complains when passing the objname_ht to rhltable_lookup().
Products Associated with CVE-2026-74565
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 4d44175aa5bb5f68772b1eb0306554812294ca52 and below 1948e4f85b855618b5b9a27265f98d816f4cb7cb is affected.
- Version 4d44175aa5bb5f68772b1eb0306554812294ca52 and below 63ba12b664a2cd3220ed43e22c717715f4cc2ae8 is affected.
- Version 4d44175aa5bb5f68772b1eb0306554812294ca52 and below 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af is affected.
- Version 4d44175aa5bb5f68772b1eb0306554812294ca52 and below f4f699790590bd0896c48a71e9232a65198f92f0 is affected.
- Version 5.1 is affected.
- Before 5.1 is unaffected.
- Version 6.12.103, <= 6.12.* is unaffected.
- Version 6.18.44, <= 6.18.* is unaffected.
- Version 7.1.8, <= 7.1.* is unaffected.
- Version 7.2-rc6, <= * is unaffected.