CVE-2026-97998
Received Received - Intake

nfnetlink_log Race Condition in Linux Kernel

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 -> 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspace can force a situation where a queue is pending for destruction from netlink event while a different socket with same portid processes an UNBIND request. With right timing, this will unhash the instance again: Oops: general protection fault, [..] Call Trace: <TASK> nfulnl_recv_config+0x31a/0xd50 nfnetlink_rcv_msg+0x7c2/0xeb0

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97998
EUVD
EUVD-2026-86652

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the netfilter subsystem. It involves a race condition where concurrent destruction of netfilter logging instances can lead to a use-after-free scenario. The issue occurs when userspace forces a queue pending destruction while another socket processes an UNBIND request, causing the instance to be unhashed prematurely and triggering a kernel panic.

Detection Guidance

This vulnerability may cause kernel crashes due to race conditions in netfilter logging. Detection requires monitoring kernel logs for general protection faults or oops messages related to nfulnl_recv_config or nfnetlink_rcv_msg. Check system logs with commands like dmesg | grep -i "general protection fault" or journalctl -k | grep -i "oops"

Impact Analysis

This vulnerability could cause system crashes (kernel oops) leading to denial of service. Attackers might exploit it to trigger kernel faults, potentially causing system instability or requiring a reboot. Systems using netfilter logging features are most at risk.

Mitigation Strategies

Apply the latest Linux kernel security updates from your distribution vendor. If immediate patching is not possible, consider disabling nfnetlink_log instances temporarily or restricting access to netfilter configuration via firewall rules until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97998. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart