Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-23351— netfilter: nft_set_pipapo: split gc into unlink and reclaim phase

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于pipapo集合类型的垃圾回收未分为取消链接和回收阶段，可能导致释放后重用。

CVSS 7.8 · High EPSS 0.12% · P2

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 3c4287f62044a90e73a561aa05fc46e62da173da< 65ca51b9fb85477ab92a04295aed34b38f7c062e affected
3c4287f62044a90e73a561aa05fc46e62da173da< c0f1f85097ac2b6e7d750fe4d05807985cd3fd3a affected
3c4287f62044a90e73a561aa05fc46e62da173da< 16f3595c0441d87dfa005c47d8f95be213afaa9e affected
3c4287f62044a90e73a561aa05fc46e62da173da< 7864c667aed01a58b87ca518a631322cd0ac34c0 affected
3c4287f62044a90e73a561aa05fc46e62da173da< c12d570d71920903a1a0468b7d13b085203d0c93 affected
3c4287f62044a90e73a561aa05fc46e62da173da< 500a50a301ce962b019ab95053ac70264fec2c21 affected
3c4287f62044a90e73a561aa05fc46e62da173da< aff13667708dfa0dce136b8efd81baa9fa6ef261 affected
3c4287f62044a90e73a561aa05fc46e62da173da< 9df95785d3d8302f7c066050117b04cd3c2048c2 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-23351

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: nft_set_pipapo: split gc into unlink and reclaim phase
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_set_pipapo: split gc into unlink and reclaim phase Yiming Qian reports Use-after-free in the pipapo set type: Under a large number of expired elements, commit-time GC can run for a very long time in a non-preemptible context, triggering soft lockup warnings and RCU stall reports (local denial of service). We must split GC in an unlink and a reclaim phase. We cannot queue elements for freeing until pointers have been swapped. Expired elements are still exposed to both the packet path and userspace dumpers via the live copy of the data structure. call_rcu() does not protect us: dump operations or element lookups starting after call_rcu has fired can still observe the free'd element, unless the commit phase has made enough progress to swap the clone and live pointers before any new reader has picked up the old version. This a similar approach as done recently for the rbtree backend in commit 35f83a75529a ("netfilter: nft_set_rbtree: don't gc elements on insert").
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于pipapo集合类型的垃圾回收未分为取消链接和回收阶段，可能导致释放后重用。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 3c4287f62044a90e73a561aa05fc46e62da173da ~ 65ca51b9fb85477ab92a04295aed34b38f7c062e -
Linux Linux 5.6 -

II. Public POCs for CVE-2026-23351

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-23351

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-23351 (6)

Same Patch Batch · Linux · 2026-03-25 · 116 CVEs total

CVE-2026-23395 8.8 HIGH Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ
CVE-2026-31788 8.2 HIGH xen/privcmd: restrict usage in unprivileged domU
CVE-2026-23340 7.8 HIGH net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs
CVE-2026-23336 7.8 HIGH wifi: cfg80211: cancel rfkill_block work in wiphy_unregister()
CVE-2026-23350 7.8 HIGH drm/xe/queue: Call fini on exec queue creation fail
CVE-2026-23317 7.8 HIGH drm/vmwgfx: Return the correct value in vmw_translate_ptr functions
CVE-2026-23306 7.8 HIGH scsi: pm8001: Fix use-after-free in pm8001_queue_command()
CVE-2026-23372 7.8 HIGH nfc: rawsock: cancel tx_work before socket teardown
CVE-2026-23378 7.8 HIGH net/sched: act_ife: Fix metalist update behavior
CVE-2026-23383 7.8 HIGH bpf, arm64: Force 8-byte alignment for JIT buffer to prevent atomic tearing
CVE-2026-23288 7.8 HIGH accel/amdxdna: Fix out-of-bounds memset in command slot handling
CVE-2026-23393 7.8 HIGH bridge: cfm: Fix race condition in peer_mep deletion
CVE-2026-23391 7.8 HIGH netfilter: xt_CT: drop pending enqueued packets on template removal
CVE-2026-23280 7.8 HIGH accel/amdxdna: Prevent ubuf size overflow
CVE-2026-23392 7.8 HIGH netfilter: nf_tables: release flowtable after rcu grace period on error
CVE-2026-23364 7.4 HIGH ksmbd: Compare MACs in constant time
CVE-2026-23294 7.0 HIGH bpf: Fix race in devmap on PREEMPT_RT
CVE-2026-23357 can: mcp251x: fix deadlock in error path of mcp251x_open
CVE-2026-23355 ata: libata: cancel pending work after clearing deferred_qc
CVE-2026-23356 drbd: fix "LOGIC BUG" in drbd_al_begin_io_nonblock()

Showing top 20 of 116 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-23351

No comments yet

Leave a comment