CVE-2026-23412 is a use-after-free vulnerability in the Linux kernel netfilter BPF subsystem where hook memory was released prematurely while concurrent RCU readers were still accessing it. This caused a slab-use-after-free error detected by KASAN during concurrent dumping of hooks via nfnetlink_hooks. The flaw could be exploited locally to cause memory corruption, leading to potential privilege escalation or system compromise. The vulnerability affects multiple Linux kernel versions prior to 6.8.0-1064.72 and related variants. The issue has been resolved by deferring the release of hook memory until all concurrent RCU readers have completed. The vendor advisory from Ubuntu confirms the patch availability and advises updating to fixed kernel versions. Due to an ABI change, recompilation of third-party kernel modules is required after update.

The vulnerability allows local attackers with limited privileges to exploit a use-after-free condition in the netfilter BPF subsystem, potentially leading to privilege escalation and full system compromise. The CVSS 3.1 score of 7.8 indicates high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, but the flaw could be leveraged to execute arbitrary code or cause denial of service.

A patch is available and has been released by the vendor. Users should update their Linux kernel to the fixed versions listed in the advisory and reboot their systems to apply the changes. Due to an ABI change in the kernel update, recompilation and reinstallation of all third-party kernel modules are required. Follow the vendor's update instructions carefully to ensure full remediation.