UBUNTU-CVE-2026-74624: High severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrack: defer invalid log until after unlock TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held. When invalid logging is routed to nfnetlinklog and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct->lock, so logging while holding that lock can deadlock. Defer the TCP invalid logs by storing only the minimal log context while ct->lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking. Do the same for the SCTP invalid state-transition log that can be reached while ct->lock is held. Add a lockdep assertion to nfctl4protologinvalid() so future callers that log invalid conntracks while holding ct->lock are caught outside TCP and SCTP as well.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so callers that log invalid conntracks while holding ct->lock are detected outside TCP and SCTP.
- Compensating control
Defer TCP and SCTP invalid-packet logging until after ct->lock is released: have the TCP timeout-lowering invalid path return whether logging is needed, store only minimal log context while the lock is held, and emit the TCP or SCTP log after unlocking.
Event History
Frequently Asked Questions
Which systems are exposed to the deadlock condition?
The affected software list includes Ubuntu linux-riscv, linux-realtime, linux-azure, linux-gcp, linux-azure-fde, linux-gke, linux-hwe-edge, and linux-gkeop kernel packages. The deadlock scenario specifically requires invalid-packet logging to be routed through nfnetlink_log with conntrack export enabled.
What could trigger the issue?
An unauthenticated remote attacker can send traffic that reaches invalid TCP or SCTP conntrack handling. If the relevant logging and conntrack-export configuration is active, logging can re-enter conntrack netlink processing while the conntrack lock is held, causing a deadlock and availability impact.
Is a default configuration known to be affected?
The provided information does not establish whether the required nfnetlink_log routing and conntrack export settings are enabled by default. Systems should be reviewed for those settings before assuming exposure.
What can be done before applying the kernel fix?
Where operationally feasible, avoid routing invalid conntrack logs to nfnetlink_log while conntrack export is enabled. This removes the configuration combination described as allowing the logging path to re-enter conntrack netlink handling.