Skip to content
CVE PROGRAM SOURCE RECORD7.0 High

CVE-2026-97608

netfilter: nf_log: unregister loggers before per-net teardown

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink_log unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or netlink writer can rebind the still- registered logger after the per-net pre-exit callback cleared the old selection. The race looks like this: CPU 0 CPU 1 ---- ---- unregister_pernet_subsys() nf_log_unset(net, logger) net->nf.nf_loggers[pf] = NULL lock nf_log_mutex find logger in loggers[][] net->nf.nf_loggers[pf] = logger unlock nf_log_mutex nf_log_unregister(logger) lock nf_log_mutex loggers[pf][type] = NULL unlock nf_log_mutex synchronize_rcu() module exit returns module core frees backend memory Later, a sysctl read or packet logging operation can dereference the stale per-net logger pointer. Fix this by unregistering the global logger backends before tearing down per-net state. Once the global registrations are gone, later writers can no longer rebind the logger. unregister_pernet_subsys() already waits for an RCU grace period after the pre-exit callback clears the per-net selection, while nf_log_unregister() continues to cover readers of the global logger table. Apply this ordering fix to both nf_log backends that combine per-net teardown with global logger registration.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 5b023fc8d8e0997e0b7ea6506d243afd5478c96e to < 51417230716b73f6aa1dc402b3a56d3382a694dcaffected
  • 5b023fc8d8e0997e0b7ea6506d243afd5478c96e to < b0514ca1ee6f2b708d6c602ea946acdfc6a90e24affected
  • 5b023fc8d8e0997e0b7ea6506d243afd5478c96e to < 90166834b7dc6131aa42b6b14b8b4ed47be97079affected
  • 5b023fc8d8e0997e0b7ea6506d243afd5478c96e to < eaec35fae8f2052c1878a5c7cc7699d8357d79f2affected
  • 5b023fc8d8e0997e0b7ea6506d243afd5478c96e to < 64803ba0a05791cf9ca874466480e4c4cadaf7abaffected
  • 5b023fc8d8e0997e0b7ea6506d243afd5478c96e to < dce24f3a146948595bb1b86347f31e20b4975daaaffected
  • 5b023fc8d8e0997e0b7ea6506d243afd5478c96e to < 2c018cc4842c33f0c732962e2ab58635e8ae5823affected

Linux Linux

Default version status: affected

  • 3.10affected
  • 0 to < 3.10unaffected
  • 5.15.222 to ≤ 5.15.*unaffected
  • 6.1.189 to ≤ 6.1.*unaffected
  • 6.6.158 to ≤ 6.6.*unaffected
  • 6.12.111 to ≤ 6.12.*unaffected
  • 6.18.53 to ≤ 6.18.*unaffected
  • 7.2.7 to ≤ 7.2.*unaffected
  • 7.3 to ≤ *unaffected

References