CVE-2026-46324: netfilter: nf_tables: use list_del_rcu for netlink hooks

Synopsis

A use-after-free race condition exists in the Linux kernel's netfilter nf_tables subsystem. The flaw is reachable locally by a low-privileged user and stems from nft_netdev_unregister_hooks and __nft_unregister_flowtable_net_hooks using list_del instead of list_del_rcu, allowing concurrent RCU readers (such as netlink dumpers) to walk a list entry that has already been freed. Successful exploitation gives an attacker full read, write, and crash capability over the affected kernel. Patched-image rebuilds at the fix commits targeting the 4.20 and 5.5 stable lines are available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityNot required

  The attacker needs an existing shell or process on the host; no network access to the service is required.

• AuthenticationRequired

  Any low-privilege local account is sufficient to trigger the vulnerable code path; no administrative credentials are needed.

• Victim interactionNot required

  Exploitation is fully attacker-driven; no action from another user or administrator is required.

• Attack complexityDetail

  The exploit is reliable and condition-free once local access exists; no race-window tuning or memory-layout knowledge beyond the RCU race itself is required.

Blast Radius

• A successful attacker reads arbitrary kernel memory, including stored credentials, session tokens, and sensitive process data.
• The attacker writes to kernel memory, allowing privilege escalation to root or modification of security-policy structures such as SELinux or AppArmor state.
• The attacker crashes the kernel entirely, taking down all containers and workloads on the affected node.
• Any container sharing the host kernel is exposed; a breakout from a restricted container is achievable once kernel write primitives are obtained.