CVE-2026-23458

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlink_dump_exp_ct() ctnetlink_dump_exp_ct() stores a conntrack pointer in cb->data for the netlink dump callback ctnetlink_exp_ct_dump_table(), but drops the conntrack reference immediately after netlink_dump_start(). When the dump spans multiple rounds, the second recvmsg() triggers the dump callback which dereferences the now-freed conntrack via nfct_help(ct), leading to a use-after-free on ct->ext. The bug is that the netlink_dump_control has no .start or .done callbacks to...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < d8cd0efbccc5cfb0a80da744a7da76e1333ab925, >= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < 9821b47f669eb82791fa0b1a6ebaf9aa219bea72, >= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < bdf2724eefd4455a66863abb025bab8d3aa98c57, >= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < f04cc86d59906513d2d62183b882966fc0ae0390, >= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < f025171feef2ac65663d7986f1d5ff0c28d6b2a9, >= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < 04c8907ce4e3d3e26c5e1a3e47aa5d17082cbb56, >= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < cd541f15b60e2257441398cf495d978f816d09f8, >= e844a928431fa8f1359d1f4f2cef53d9b446bf52 < 5cb81eeda909dbb2def209dd10636b51549a3f8a, >= 3.10, >= V3.1.6, >= V3.1.5, >= 3.10 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.167, >= 6.2 < 6.6.130, >= 6.7 < 6.12.78, >= 6.13 < 6.18.20, >= 6.19 < 6.19.10, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.167, 6.6.130, 6.12.78, 6.18.20, 6.19.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416