CVE-2026-80837

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: don't queue packet path object notifications

All file:line references below are against v7.2-rc4 (ac5b0e5651b1). The

trace was captured on 7.2.0-rc6-kasan72rc6 (075b74841bd0), where the same

lines apply.

nft_obj_notify() is exported and reached from the packet path. Its only

in-tree caller is nft_quota_obj_eval() (net/netfilter/nft_quota.c:68),

which notifies with GFP_ATOMIC while evaluating a rule for a transiting

packet, holding no mutex.

Since commit 67cc570edaa0 ("netfilter: nf_tables: coalesce multiple

notifications into one skbuff") that notification is no longer sent

immediately. __nft_obj_notify() queues it onto nft_net->notify_list via

nft_notify_enqueue() (net/netfilter/nf_tables_api.c:1211), which is a bare

list_add_tail(). notify_list has no lock of its own

(include/net/netfilter/nf_tables.h:1951), it is serialised by commit_mutex:

the six other enqueue sites all run inside a netli

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References