CVE-2026-97608
Received Received - Intake

Race Condition in Linux Kernel Netfilter Logging Subsystem

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink_log unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or netlink writer can rebind the still- registered logger after the per-net pre-exit callback cleared the old selection. The race looks like this: CPU 0 CPU 1 ---- ---- unregister_pernet_subsys() nf_log_unset(net, logger) net->nf.nf_loggers[pf] = NULL lock nf_log_mutex find logger in loggers[][] net->nf.nf_loggers[pf] = logger unlock nf_log_mutex nf_log_unregister(logger) lock nf_log_mutex loggers[pf][type] = NULL unlock nf_log_mutex synchronize_rcu() module exit returns module core frees backend memory Later, a sysctl read or packet logging operation can dereference the stale per-net logger pointer. Fix this by unregistering the global logger backends before tearing down per-net state. Once the global registrations are gone, later writers can no longer rebind the logger. unregister_pernet_subsys() already waits for an RCU grace period after the pre-exit callback clears the per-net selection, while nf_log_unregister() continues to cover readers of the global logger table. Apply this ordering fix to both nf_log backends that combine per-net teardown with global logger registration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97608
EUVD
EUVD-2026-86739

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the netfilter logging subsystem. It occurs when two network namespace operations unregister loggers in the wrong order, leaving a window where a stale logger pointer can be accessed. The issue arises because per-network namespace cleanup happens before global logger backend unregistration, allowing a sysctl or netlink writer to rebind a logger after the old selection is cleared.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter logging subsystem. Detection requires checking kernel logs for unusual netfilter logger behavior or crashes during network namespace teardown. Monitor for kernel oops messages or syslog entries related to nf_log or nfnetlink_log modules. No direct user-space commands detect this, but kernel logs and system crash reports may reveal issues.

Impact Analysis

This vulnerability could lead to kernel memory corruption or crashes if an attacker exploits the race condition to dereference a stale logger pointer. Systems relying on netfilter logging for security monitoring may experience instability or incorrect logging behavior, potentially affecting network security operations.

Mitigation Strategies

Apply the kernel patch that fixes the race condition in nf_log and nfnetlink_log modules. Update to a Linux kernel version that includes the fix. If immediate patching is not possible, restrict access to sysctl and netlink operations that interact with netfilter logging until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97608. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart