CVE-2026-98624
Received Received - Intake

Race Condition in Linux Kernel Netfilter nfnetlink_queue

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close() which can call the release function while unrelated socket processes UNBIND request for same portid: Oops: general protection fault, [..] RIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue] Call Trace: nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue] nfnetlink_rcv_msg+0x7c2/0xeb0 ? __pfx_nfnetlink_rcv_msg+0x10/0x10 After this, parallel UNBIND and URELEASE events are impossible. This change isn't nice, but its the shortest fix given instances are not refcounted and the nfnetlink config callback drops the rcu read lock early due to need for sleeping allocations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98624
EUVD
EUVD-2026-103538

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 2.6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the netfilter subsystem. It involves a race condition where concurrent operations on a netlink socket can lead to a general protection fault. Specifically, a close() call triggering a release function while another process issues an UNBIND request for the same port ID causes kernel instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter subsystem, particularly the nfnetlink_queue component. Detection requires checking kernel logs for general protection faults related to __instance_destroy in nfnetlink_queue. Monitor logs for Oops messages or kernel panics involving nfqnl_recv_config or nfnetlink_rcv_msg.

Impact Analysis

This vulnerability can cause system crashes (kernel oops) due to memory corruption or invalid memory access. It may lead to denial-of-service conditions where the affected system becomes unresponsive or requires a reboot.

Compliance Impact

This vulnerability is a Linux kernel issue related to netfilter nfnetlink_queue, causing a general protection fault due to improper synchronization between release and config operations. It does not directly impact compliance with GDPR, HIPAA, or similar standards as it is a low-level system crash rather than a data exposure or privacy issue.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If patches are unavailable, consider disabling the nfnetlink_queue module temporarily or restricting access to netfilter configuration via firewall rules until an update is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart