PT-2026-27750 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-03-26 · CVE-2026-23385

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The Linux kernel contains a flaw within the netfilter subsystem, specifically in the nf tables component, related to set cloning during flushing operations. A Syzbot, utilizing fault injection, identified a memory allocation failure with GFP KERNEL, leading to a kernel warning. The issue arises from improper handling of set cloning during the flush process. The resolution involves restricting set cloning to the flush set command during the preparation phase, introducing the NFT ITER UPDATE CLONE iteration type, and updating the rbtree and pipapo backends to clone sets only when this iteration type is used. This prevents unnecessary cloning of sets being deleted, including bound anonymous sets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2026-23385

Affected Products

Linux Kernel

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23385.json · Exploit
• https://git.kernel.org/stable/c/b7f67282ca2be14b727dd698b50e10cf5d8c66f9 · Patch
• https://osv.dev/vulnerability/CVE-2026-23385 · Vendor Advisory
• https://git.kernel.org/stable/c/9154945a6394029822bd08c24cef5a3f86d0424a · Patch
• https://osv.dev/vulnerability/BELL-CVE-2026-23385 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-23385 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23385 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-23385 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23385 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-23385 · Vendor Advisory
• https://git.kernel.org/stable/c/fb7fb4016300ac622c964069e286dc83166a5d52 · Patch
• https://ubuntu.com/security/CVE-2026-23385 · Vendor Advisory
• https://twitter.com/CVEnew/status/2036763456968278203 · Twitter Post
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note
• https://docs.bell-sw.com/security/cves/CVE-2026-23385 · Note