{"id":"CVE-2026-23391","revision":"0ceb375c731643e59a226aae637fcb4b","records":[{"revision":"0ceb375c731643e59a226aae637fcb4b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-23391","aliases":[],"title":"netfilter: xt_CT: drop pending enqueued packets on template removal","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: xt_CT: drop pending enqueued packets on template removal\n\nTemplates refer to objects that can go away while packets are sitting in\nnfqueue refer to:\n\n- helper, this can be an issue on module removal.\n- timeout policy, nfnetlink_cttimeout might remove it.\n\nThe use of templates with zone and event cache filter are safe, since\nthis just copies values.\n\nFlush these enqueued packets in case the template rule gets removed.","state":0,"publishedAt":"2026-03-25T10:33:15.677+00:00","modifiedAt":"2026-10-19T18:35:42.172+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/xt_CT.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"55445134d42b84cb0a272e42c98d233ca65eca83\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"cc57506dd66555899560b9c0f24e813f034e12ec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"d2d0bae0c9a2a17b6990a2966f5cdce0813d6256\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"63b8097cea1923fe82cd598068d0796da8c015ec\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"19a230dec6bb8928e3f96387f9085cf2c79bcef9\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"cb549925875fa06dd155e49db4ac2c5044c30f9c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"777d02efe3d630cca4c1b63962cec17c57711325\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"24de58f465165298aaa8f286b2592f0163706cfe\",\n                            \"lessThan\": \"f62a218a946b19bb59abdd5361da85fa4606b96b\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/xt_CT.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"3.4\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"3.4\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.253\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.203\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.167\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.130\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.78\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.20\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.10\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/55445134d42b84cb0a272e42c98d233ca65eca83","https://git.kernel.org/stable/c/cc57506dd66555899560b9c0f24e813f034e12ec","https://git.kernel.org/stable/c/d2d0bae0c9a2a17b6990a2966f5cdce0813d6256","https://git.kernel.org/stable/c/63b8097cea1923fe82cd598068d0796da8c015ec","https://git.kernel.org/stable/c/19a230dec6bb8928e3f96387f9085cf2c79bcef9","https://git.kernel.org/stable/c/cb549925875fa06dd155e49db4ac2c5044c30f9c","https://git.kernel.org/stable/c/777d02efe3d630cca4c1b63962cec17c57711325","https://git.kernel.org/stable/c/f62a218a946b19bb59abdd5361da85fa4606b96b"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23391","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-23391","identifiers":["CVE-2026-23391"]},"retained":false,"historicalAffected":[]}],"coverage":[]}