In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_CT: drop pending enqueued packets on template removal

Templates refer to objects that can go away while packets are sitting in
nfqueue refer to:

- helper, this can be an issue on module removal.
- timeout policy, nfnetlink_cttimeout might remove it.

The use of templates with zone and event cache filter are safe, since
this just copies values.

Flush these enqueued packets in case the template rule gets removed.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00024.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
24de58f465165298aaa8f286b2592f0163706cfe affected < d2d0bae0c9a2a17b6990a2966f5cdce0813d6256
24de58f465165298aaa8f286b2592f0163706cfe affected < 63b8097cea1923fe82cd598068d0796da8c015ec
24de58f465165298aaa8f286b2592f0163706cfe affected < 19a230dec6bb8928e3f96387f9085cf2c79bcef9
24de58f465165298aaa8f286b2592f0163706cfe affected < cb549925875fa06dd155e49db4ac2c5044c30f9c
24de58f465165298aaa8f286b2592f0163706cfe affected < 777d02efe3d630cca4c1b63962cec17c57711325
24de58f465165298aaa8f286b2592f0163706cfe affected < f62a218a946b19bb59abdd5361da85fa4606b96b
Linux Linux affected
Version Status Constraints
3.4 affected —
0 unaffected < 3.4
6.1.167 unaffected ≤ 6.1.*
6.6.130 unaffected ≤ 6.6.*
6.12.78 unaffected ≤ 6.12.*
6.18.20 unaffected ≤ 6.18.*
6.19.10 unaffected ≤ 6.19.*
7.0-rc5 unaffected ≤ *

No data.

No data.

No data.

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/19a230dec6bb8928e3f96387f9085cf2c79bcef9 cve-icon cve-icon
https://git.kernel.org/stable/c/63b8097cea1923fe82cd598068d0796da8c015ec cve-icon cve-icon
https://git.kernel.org/stable/c/777d02efe3d630cca4c1b63962cec17c57711325 cve-icon cve-icon
https://git.kernel.org/stable/c/cb549925875fa06dd155e49db4ac2c5044c30f9c cve-icon cve-icon
https://git.kernel.org/stable/c/d2d0bae0c9a2a17b6990a2966f5cdce0813d6256 cve-icon cve-icon
https://git.kernel.org/stable/c/f62a218a946b19bb59abdd5361da85fa4606b96b cve-icon cve-icon
History

Wed, 25 Mar 2026 10:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_CT: drop pending enqueued packets on template removal Templates refer to objects that can go away while packets are sitting in nfqueue refer to: - helper, this can be an issue on module removal. - timeout policy, nfnetlink_cttimeout might remove it. The use of templates with zone and event cache filter are safe, since this just copies values. Flush these enqueued packets in case the template rule gets removed.
Title netfilter: xt_CT: drop pending enqueued packets on template removal
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-03-25T10:33:15.677Z

Reserved: 2026-01-13T15:37:46.009Z

Link: CVE-2026-23391

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-03-25T11:16:39.707

Modified: 2026-03-25T11:16:39.707

Link: CVE-2026-23391

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.