CVE-2026-97998: netfilter: nfnetlink_log: cope with concurrent instance destruction
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlinklog: cope with concurrent instance destruction
Instances are refcounted. However, only memory release happens on the 1 -> 0 transition; the unlink from hashes can occur with any refcount.
Uncooperative userspace can force a situation where a queue is pending for destruction from netlink event while a different socket with same portid processes an UNBIND request.
With right timing, this will unhash the instance again:
Oops: general protection fault, [..] Call Trace: <TASK> nfulnlrecvconfig+0x31a/0xd50 nfnetlinkrcvmsg+0x7c2/0xeb0
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the fault?
An uncooperative userspace client must create a timing race between destruction of an nfnetlink_log queue through a netlink event and an UNBIND request processed by a different socket using the same port ID. The race can cause the instance to be removed from the hash a second time.
What is the observed impact when the race succeeds?
The reported outcome is a general protection fault in the kernel, with the call trace reaching nfulnl_recv_config via nfnetlink_rcv_msg. This indicates a kernel crash condition.