CVE-2026-98624
Received Received - Intake

Race Condition in Linux Kernel Netfilter nfnetlink_queue

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier We must serialize the release notifier and the config netlink function. A concurrent thread can issue close() which can call the release function while unrelated socket processes UNBIND request for same portid: Oops: general protection fault, [..] RIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue] Call Trace: nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue] nfnetlink_rcv_msg+0x7c2/0xeb0 ? __pfx_nfnetlink_rcv_msg+0x10/0x10 After this, parallel UNBIND and URELEASE events are impossible. This change isn't nice, but its the shortest fix given instances are not refcounted and the nfnetlink config callback drops the rcu read lock early due to need for sleeping allocations.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98624
EUVD
EUVD-2026-103538

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb
Linux Linux 2.6.14

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the netfilter subsystem. It involves a race condition where concurrent operations on a netlink socket can lead to a general protection fault. Specifically, a close() call triggering a release function while another process issues an UNBIND request for the same port ID causes kernel instability.

Impact Analysis

This vulnerability can cause system crashes (kernel oops) due to memory corruption or invalid memory access. It may lead to denial-of-service conditions where the affected system becomes unresponsive or requires a reboot.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98624. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart