CVE-2026-97609
Received Received - Intake

Use-After-Free in Linux Kernel Netfilter cttimeout

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: prevent UAF during module unload nf_ct_set_timeout() protects the timeout hook dereference and policy lookup with rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net operations before it clears the hook. This allows the following interleaving: CPU 0 CPU 1 cttimeout_exit() nf_ct_set_timeout() unregister_pernet_subsys() rcu_read_lock() kfree(pernet) h = nf_ct_timeout_hook h->timeout_find_get() nfct_timeout_pernet() The hook still points to ctnl_timeout_find_get() when CPU 1 looks up the already freed per-net timeout list. KASAN reported: BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get Read of size 8 by task poc/90 Call Trace: ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout] nf_ct_set_timeout+0x7b/0x3c0 xt_ct_tg_check+0x724/0xb20 xt_check_target+0x234/0xa90 do_ipt_set_ctl+0x570/0x1270 Allocated by task 89: __kmalloc_noprof+0x16e/0x460 ops_init+0x6d/0x420 register_pernet_operations+0x2f6/0x670 Freed by task 91: kfree+0x131/0x390 ops_undo_list+0x3d4/0x730 unregister_pernet_operations+0x232/0x490 unregister_pernet_subsys+0x1c/0x30 cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout] Clear the hook and wait for existing readers before unregistering the per-net operations. This blocks new policy lookups and ensures readers that observed the hook finish before the per-net storage is freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97609
EUVD
EUVD-2026-86740

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netfilter nfnetlink_cttimeout *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's netfilter subsystem, specifically in the cttimeout module. It occurs during module unload when the per-net operations are unregistered before the timeout hook is cleared. This allows a race condition where a freed memory location is accessed by another CPU, leading to potential crashes or arbitrary code execution.

Detection Guidance

This vulnerability involves a use-after-free condition in the Linux kernel's netfilter subsystem. Detection requires checking for kernel logs indicating slab-use-after-free errors related to nfnetlink_cttimeout. Monitor dmesg or system logs for KASAN reports mentioning ctnl_timeout_find_get or nf_ct_set_timeout.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges. This could lead to denial-of-service conditions or unauthorized access to sensitive system resources. Systems using netfilter with the cttimeout module are at risk.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to resolve the issue. If immediate patching is not possible, consider disabling the nfnetlink_cttimeout module to prevent exploitation. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97609. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart