netfilter: nf_tables: make nft_object rhltable per table (CVE-2026-74565) | HOL Guard CVE

High · CVSS 7.8CVE-2026-74565

netfilter: nf_tables: make nft_object rhltable per table

Answer in brief

CVE-2026-74565 records a High severity (CVSS 7.8) vulnerability in netfilter: nf_tables: make nft_object rhltable per table. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Aug 15, 2026Updated Sep 14, 2026Source checked Sep 29, 2026First seen by HOL Aug 15, 2026Material review Sep 14, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 7.8
Exploitation: Not marked as known exploited
Affected software: 3 mapped packages or products
Fix availability: Available

Why this deserves its current priority

CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Linux/Linuxgeneric	>=4d44175aa5bb5f68772b1eb0306554812294ca52 <1948e4f85b855618b5b9a27265f98d816f4cb7cb \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <63ba12b664a2cd3220ed43e22c717715f4cc2ae8 \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <f4f699790590bd0896c48a71e9232a65198f92f0	1948e4f85b855618b5b9a27265f98d816f4cb7cb, 63ba12b664a2cd3220ed43e22c717715f4cc2ae8, 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af, f4f699790590bd0896c48a71e9232a65198f92f0
Linux/Linuxgeneric	5.1	Not reported
Linux/Linuxgeneric	>=4d44175aa5bb5f68772b1eb0306554812294ca52 <4b549d32d34ee765527e63726bb1af984876e776 \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <523c881661dde67efb44fce38c8eed50a72a57c1 \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <1948e4f85b855618b5b9a27265f98d816f4cb7cb \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <63ba12b664a2cd3220ed43e22c717715f4cc2ae8 \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af \|\| >=4d44175aa5bb5f68772b1eb0306554812294ca52 <f4f699790590bd0896c48a71e9232a65198f92f0	4b549d32d34ee765527e63726bb1af984876e776, 523c881661dde67efb44fce38c8eed50a72a57c1, 1948e4f85b855618b5b9a27265f98d816f4cb7cb, 63ba12b664a2cd3220ed43e22c717715f4cc2ae8, 7d4789b58761d9d48d9b5f5e7e0a510c3bbfb3af, f4f699790590bd0896c48a71e9232a65198f92f0

Recommended response

Check inventory. Check lockfiles and deployed manifests for Linux/Linux, Linux/Linux, Linux/Linux.
Review the reported fix. Update Linux/Linux to 1948e4f85b855618b5b9a27265f98d816f4cb7cb; Linux/Linux to 4b549d32d34ee765527e63726bb1af984876e776 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Sep 14, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Aug 15, 2026

Sources and claim methodology

Upstream source description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: make nft_object rhltable per table The nft_object rhltable is global, this allows for accessing objects that are being dismangled from lookup path by other existing netns. Given the nft_obj_destroy() releases the object inmediately, this might lead to use-after-free of these objects that are being released. Make the existing rhltable per table to address this issue to deal with with the nft_rcv_nl_event() path too. Update nft_obj_lookup() to take the table as non-const, otherwise, compiler complains when passing the objname_ht to rhltable_lookup().

Quoted source text, attributed separately from HOL analysis.