CVE-2026-74624

Received Received - Intake

Invalid Log Deadlock in Linux Kernel Netfilter

Publication date: 2026-08-22

Last updated on: 2026-08-25

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held. When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct->lock, so logging while holding that lock can deadlock. Defer the TCP invalid logs by storing only the minimal log context while ct->lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking. Do the same for the SCTP invalid state-transition log that can be reached while ct->lock is held. Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct->lock are caught outside TCP and SCTP as well.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-22

Last Modified

2026-08-25

Generated

2026-09-12

AI Q&A

2026-08-22

EPSS Evaluated

2026-09-10

NVD

CVE-2026-74624

EUVD

EUVD-2026-64561

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a deadlock risk in the netfilter connection tracking system. When handling invalid TCP or SCTP packets, the system logs errors while holding a lock (ct->lock). If logging is routed to nfnetlink_log with conntrack export enabled, it can re-enter the netlink glue code, attempt to dump the same connection tracking entry, and try to acquire the same lock again, causing a deadlock.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter connection tracking subsystem. Detection primarily involves checking kernel logs for invalid packet logs or deadlock conditions related to nf_conntrack. Monitor logs for messages indicating issues with TCP or SCTP connection tracking while holding ct->lock. Use commands like dmesg or journalctl to inspect kernel logs for errors or warnings related to netfilter or conntrack.

Impact Analysis

This vulnerability can cause system hangs or crashes due to deadlocks in the Linux kernel's networking stack. If exploited, it may lead to denial-of-service conditions, disrupting network services and connectivity on affected systems.

Compliance Impact

This vulnerability in the Linux kernel's netfilter conntrack subsystem could lead to system instability or denial-of-service conditions due to potential deadlocks. While it does not directly expose data, such disruptions may impact the availability of systems handling sensitive data, which could affect compliance with availability requirements in standards like GDPR and HIPAA.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-74624. Monitor kernel security advisories for patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-74624. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70