CVE-2026-97608: netfilter: nf_log: unregister loggers before per-net teardown
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nflog: unregister loggers before per-net teardown
nflogsyslog and nfnetlinklog unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or netlink writer can rebind the still- registered logger after the per-net pre-exit callback cleared the old selection.
The race looks like this:
CPU 0 CPU 1 ---- ---- unregisterpernetsubsys() nflogunset(net, logger) net->nf.nfloggers[pf] = NULL
lock nflogmutex find logger in loggers[][] net->nf.nfloggers[pf] = logger unlock nflogmutex
nflogunregister(logger) lock nflogmutex loggers[pf][type] = NULL unlock nflogmutex synchronizercu() module exit returns module core frees backend memory
Later, a sysctl read or packet logging operation can dereference the stale per-net logger pointer.
Fix this by unregistering the global logger backends before tearing down per-net state. Once the global registrations are gone, later writers can no longer rebind the logger. unregisterpernetsubsys() already waits for an RCU grace period after the pre-exit callback clears the per-net selection, while nflogunregister() continues to cover readers of the global logger table.
Apply this ordering fix to both nflog backends that combine per-net teardown with global logger registration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In both nf_log_syslog and nfnetlink_log backends, unregister the global logger backends with nf_log_unregister(logger) before per-network teardown via unregister_pernet_subsys(); perform nf_log_unset(net, logger) and synchronize_rcu() so later sysctl or netlink writers cannot rebind stale per-net logger pointers.
Event History
Frequently Asked Questions
Who is exposed to this race condition?
Systems using the Linux kernel netfilter logging components nf_log_syslog or nfnetlink_log are exposed during module teardown, because their per-network logger selection can be rebound after per-network cleanup but before the global logger backend is removed.
What conditions are needed to trigger it?
A concurrent sysctl or netlink writer must rebind a logger while the affected logging module is being unloaded and its per-network namespace operations are being unregistered. A later sysctl read or packet logging operation can then dereference the stale logger pointer after the backend memory is freed.
How does the fix prevent exploitation?
The fix unregisters global logger backends before tearing down per-network state. This prevents later sysctl or netlink writers from finding and rebinding a logger after the per-network logger selection has been cleared.