The vulnerability in Linux kernel netfilter nf_tables arises from unconditionally incrementing the set->nelems counter before insertion, even when the set is full. This causes a new element to be published and then removed without waiting for the RCU grace period, while an RCU reader might still be accessing it, leading to potential use-after-free conditions. The fix involves adding the element transaction regardless of fullness but toggling the set_full flag to return an error (-ENFILE) so that the abort path can safely revert the set state. For element updates, the set->nelems counter is decremented to maintain consistency. An alternative fix involving synchronize_rcu() was considered but rejected due to performance concerns with large batches.

This vulnerability can cause use-after-free conditions in the kernel's netfilter subsystem, potentially leading to memory corruption with high impact on confidentiality, integrity, and availability. Exploitation could allow local attackers with limited privileges to cause kernel crashes or execute arbitrary code with kernel privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official patch or workaround links are provided in the available data. Monitor the Microsoft Security Response Center advisory (msrc_CVE-2026-23272) for updates and apply official fixes once available.