In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_ct: fix use-after-free in timeout object destroy
nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data().
Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c.
KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80
Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320
Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00
Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade perf-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade python-perfUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-5.15.204-143.230Upgrade kernel-headersUpgrade kernel-toolsUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-develUpgrade kernel-livepatch-5.10.253-252.1015Upgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade perf | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-headersUpgrade kernel-livepatch-6.1.170-210.320Upgrade kernel-develUpgrade kernel-toolsUpgrade perf-debuginfoUpgrade kernel-tools-develUpgrade python3-perfUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-modules-extra-commonUpgrade perfUpgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-modules-extraUpgrade python3-perf-debuginfoUpgrade kernel | May 19, 2026 | Apr 24, 2026 |
| Debian | — | Upgrade linux-6.1Upgrade linux | May 3, 2026 | May 3, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Apr 24, 2026 |
| Ubuntu | — | Upgrade linux-image-aws-64k-lts-24.04Upgrade linux-image-gcp-fips-5.15Upgrade linux-image-aws-64k-6.8Upgrade linux-image-generic-lpaeUpgrade linux-image-5.15.0-1106-raspiUpgrade linux-image-5.15.0-1108-gkeUpgrade linux-image-6.8.0-1062-azure-fdeUpgrade linux-image-6.8.0-1059-nvidia-lowlatency-64kUpgrade linux-image-raspi-6.8Upgrade linux-image-5.15.0-1064-nvidia-tegraUpgrade linux-image-azure-fipsUpgrade linux-image-raspi-5.15Upgrade linux-image-6.8.0-1061-raspiUpgrade linux-image-gke-64k-6.8Upgrade linux-image-6.8.0-1061-awsUpgrade linux-image-6.8.0-1058-oracleUpgrade linux-image-5.15.0-186-generic-64kUpgrade linux-image-6.8.0-1059-nvidia-lowlatencyUpgrade linux-image-azure-lts-22.04Upgrade linux-image-generic-64k-hwe-20.04Upgrade linux-image-raspiUpgrade linux-image-nvidia-lowlatency-5.15Upgrade linux-image-intel-iot-realtime-5.15Upgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1061-ibmUpgrade linux-image-azure-fde-lts-24.04Upgrade linux-image-5.15.0-1112-gcpUpgrade linux-image-azureUpgrade linux-image-azure-5.15Upgrade linux-image-nvidia-64k-hwe-22.04Upgrade linux-image-6.8.0-1059-nvidia-64kUpgrade linux-image-6.8.0-1061-aws-fipsUpgrade linux-image-aws-fips-6.8Upgrade linux-image-oracle-64k-6.8Upgrade linux-image-raspi-realtime-6.8Upgrade linux-image-oem-20.04bUpgrade linux-image-realtime-6.8.1Upgrade linux-image-6.8.0-1061-aws-64kUpgrade linux-image-generic-6.8Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-5.15.0-1064-nvidia-tegra-rtUpgrade linux-image-oracle-5.15Upgrade linux-image-xilinx-6.8Upgrade linux-image-lowlatency-hwe-20.04Upgrade linux-image-5.15.0-186-genericUpgrade linux-image-ibm-6.8Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1059-gke-64kUpgrade linux-image-5.15.0-1104-kvmUpgrade linux-image-gcp-64kUpgrade linux-image-generic-64k-6.8Upgrade linux-image-oem-20.04dUpgrade linux-image-generic-64k-5.15Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidia-lowlatencyUpgrade linux-image-aws-lts-22.04Upgrade linux-image-gke-6.8Upgrade linux-image-6.8.0-1063-azureUpgrade linux-image-6.8.0-1063-azure-fipsUpgrade linux-image-realtime-5.15Upgrade linux-image-aws-64k-5.15Upgrade linux-image-oem-22.04bUpgrade linux-image-azure-fips-6.8Upgrade linux-image-ibmUpgrade linux-image-6.8.0-1030-nvidia-tegra-rtUpgrade linux-image-generic-5.15Upgrade linux-image-lowlatency-64k-hwe-20.04Upgrade linux-image-gcp-fipsUpgrade linux-image-5.15.0-1117-azure-fipsUpgrade linux-image-6.8.0-1046-gkeopUpgrade linux-image-6.8.0-1064-gcp-64kUpgrade linux-image-azure-fde-5.15Upgrade linux-image-5.15.0-186-generic-lpaeUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-oem-22.04cUpgrade linux-image-gcp-5.15Upgrade linux-image-virtual-hwe-20.04Upgrade linux-image-nvidia-5.15Upgrade linux-image-nvidia-tegra-rt-5.15Upgrade linux-image-5.15.0-1112-awsUpgrade linux-image-lowlatencyUpgrade linux-image-aws-6.8Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-5.15.0-1111-realtimeUpgrade linux-image-kvmUpgrade linux-image-nvidia-tegra-igxUpgrade linux-image-5.15.0-1104-intel-iot-realtimeUpgrade linux-image-5.15.0-1107-nvidia-lowlatencyUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidiaUpgrade linux-image-gke-5.15Upgrade linux-image-lowlatency-6.8Upgrade linux-image-6.8.0-1058-oracle-64kUpgrade linux-image-azure-lts-24.04Upgrade linux-image-fips-6.8Upgrade linux-image-azure-fdeUpgrade linux-image-gcp-lts-22.04Upgrade linux-image-nvidia-tegra-rtUpgrade linux-image-oracle-64k-lts-24.04Upgrade linux-image-aws-fips-5.15Upgrade linux-image-gkeop-6.8Upgrade linux-image-5.15.0-1117-azure-fdeUpgrade linux-image-6.8.0-1030-nvidia-tegraUpgrade linux-image-gke-64kUpgrade linux-image-awsUpgrade linux-image-raspi-nolpaeUpgrade linux-image-virtual-6.8Upgrade linux-image-azure-fde-6.8Upgrade linux-image-azure-cvmUpgrade linux-image-nvidia-lowlatency-6.8Upgrade linux-image-aws-fipsUpgrade linux-image-xilinxUpgrade linux-image-nvidia-tegra-igx-rtUpgrade linux-image-nvidia-tegra-igx-5.15Upgrade linux-image-nvidia-6.8Upgrade linux-image-gkeopUpgrade linux-image-gcp-lts-24.04Upgrade linux-image-6.8.0-2050-raspi-realtimeUpgrade linux-image-6.8.0-136-lowlatencyUpgrade linux-image-6.8.0-136-fipsUpgrade linux-image-6.8.0-1064-gcpUpgrade linux-image-oracle-lts-22.04Upgrade linux-image-aws-5.15Upgrade linux-image-6.8.0-1059-nvidiaUpgrade linux-image-5.15.0-184-lowlatencyUpgrade linux-image-5.15.0-1109-oracleUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-virtual-5.15Upgrade linux-image-oem-20.04cUpgrade linux-image-nvidia-tegra-6.8Upgrade linux-image-lowlatency-64k-5.15Upgrade linux-image-intel-iot-realtimeUpgrade linux-image-gkeop-5.15Upgrade linux-image-gcp-64k-6.8Upgrade linux-image-6.8.1-1056-realtimeUpgrade linux-image-nvidia-tegraUpgrade linux-image-5.15.0-1107-nvidiaUpgrade linux-image-lowlatency-64kUpgrade linux-image-fipsUpgrade linux-image-5.15.0-1053-nvidia-tegra-igxUpgrade linux-image-genericUpgrade linux-image-fips-5.15Upgrade linux-image-ibm-5.15Upgrade linux-image-generic-lpae-5.15Upgrade linux-image-aws-64k-lts-22.04Upgrade linux-image-6.8.0-136-genericUpgrade linux-image-5.15.0-1107-intel-iotgUpgrade linux-image-5.15.0-1075-xilinx-zynqmpUpgrade linux-image-virtualUpgrade linux-image-lowlatency-5.15Upgrade linux-image-intelUpgrade linux-image-oem-20.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-lowlatency-64k-6.8Upgrade linux-image-aws-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-nvidia-tegra-rt-6.8Upgrade linux-image-gcp-64k-lts-24.04Upgrade linux-image-realtimeUpgrade linux-image-gcp-fips-6.8Upgrade linux-image-azure-fde-lts-22.04Upgrade linux-image-aws-64kUpgrade linux-image-6.8.0-1059-gkeUpgrade linux-image-nvidia-tegra-igx-rt-5.15Upgrade linux-image-azure-fips-5.15Upgrade linux-image-laptop-23.10Upgrade linux-image-5.15.0-1117-azureUpgrade linux-image-realtime-hwe-22.04Upgrade linux-image-oracle-6.8Upgrade linux-image-intel-iotg-5.15Upgrade linux-image-5.15.0-1095-gkeopUpgrade linux-image-kvm-5.15Upgrade linux-image-generic-lpae-hwe-20.04Upgrade linux-image-6.8.0-136-lowlatency-64kUpgrade linux-image-6.8.0-1064-gcp-fipsUpgrade linux-image-5.15.0-186-fipsUpgrade linux-image-5.15.0-1053-nvidia-tegra-igx-rtUpgrade linux-image-oem-22.04dUpgrade linux-image-nvidia-hwe-22.04Upgrade linux-image-nvidia-64kUpgrade linux-image-generic-hwe-20.04Upgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-azure-6.8Upgrade linux-image-6.8.0-136-generic-64kUpgrade linux-image-6.8.0-1033-xilinxUpgrade linux-image-5.15.0-1112-gcp-fipsUpgrade linux-image-5.15.0-1112-aws-fipsUpgrade linux-image-5.15.0-1112-aws-64kUpgrade linux-image-xilinx-zynqmp-5.15Upgrade linux-image-xilinx-zynqmpUpgrade linux-image-raspi-realtimeUpgrade linux-image-oracle-lts-24.04Upgrade linux-image-oracleUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-tegra-5.15Upgrade linux-image-nvidia-lowlatency-64k-6.8Upgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-gkeUpgrade linux-image-gcp-6.8Upgrade linux-image-5.15.0-1106-ibmUpgrade linux-image-5.15.0-184-lowlatency-64kUpgrade linux-image-oracle-64kUpgrade linux-image-intel-iotg | May 25, 2026 | Apr 24, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Apr 24, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub