CVE-2026-23399 nf_tables: nft_dynset: fix possible stateful expression memleak in error path
A memory leak in the Linux kernel's nf_tables subsystem allows attackers to cause a denial of service by exhausting kernel memory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-23399?
CVE-2026-23399 is a medium-severity denial of service vulnerability in Linux kernel, published on 28 Mar 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nf_tables: nft_dynset: fix possible stateful expression memleak in error path
If cloning the second stateful expression in the element via GFP_ATOMIC fails, then the first stateful expression remains in place without being released.
unreferenced object (percpu) 0x607b97e9cab8 (size 16): comm "softirq", pid 0, jiffies 4294931867 hex dump (first 16 bytes on cpu 3): 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 backtrace (crc 0): pcpu_alloc_noprof+0x453/0xd80 nft_counter_clone+0x9c/0x190 [nf_tables] nft_expr_clone+0x8f/0x1b0 [nf_tables] nft_dynset_new+0x2cb/0x5f0 [nf_tables] nft_rhash_update+0x236/0x11c0 [nf_tables] nft_dynset_eval+0x11f/0x670 [nf_tables] nft_do_chain+0x253/0x1700 [nf_tables] nft_do_chain_ipv4+0x18d/0x270 [nf_tables] nf_hook_slow+0xaa/0x1e0 ip_local_deliver+0x209/0x330
Weakness: CWE-401
Which versions are affected by CVE-2026-23399?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-23399?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-23399 being exploited?
There is no known exploitation of CVE-2026-23399 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-81017, BELL-CVE-2026-23399, DEBIAN-CVE-2026-23399, GHSA-vfh6-r892-92wv, ROOT-OS-DEBIAN-12-CVE-2026-23399, ROOT-OS-DEBIAN-13-CVE-2026-23399 and 3 more.