CVE-2026-97998

Overview

CVE-2026-97998 is a race condition in the Linux kernel's netfilter nfnetlink_log logging subsystem. Concurrent netlink operations can cause an nfnetlink_log instance to be unhashed again after it is already pending destruction, leading to a kernel general protection fault. It matters because local actors with sufficient access to netfilter logging controls may be able to crash the system.

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: cope with concurrent instance destruction Instances are refcounted. However, only memory release happens on the 1 -> 0 transition; the unlink from hashes can occur with any refcount. Uncooperative userspace can force a situation where a queue is pending for destruction from netlink event while a different socket with same portid processes an UNBIND request. With right timing, this will unhash the instance again: Oops: general protection fault, [..] Call Trace: nfulnl_recv_config+0x31a/0xd50 nfnetlink_rcv_msg+0x7c2/0xeb0

Impact

Confidentiality and integrity are not directly indicated; the primary impact is availability through a kernel crash or denial of service. Systems running the vulnerable nfnetlink_log module are affected, especially hosts where local users or services can create or configure netfilter logging instances. The issue is local and timing-dependent, so it is less likely to be remotely exploitable without local access or a compromised local process. Defenders should treat it as a local DoS risk and prioritize patching on multi-user or containerized hosts.

Remediation

Apply the vendor or distribution kernel update that fixes the nfnetlink_log concurrent instance destruction race. If patching is delayed, disable the nfnetlink_log/nf_log module or remove netfilter logging rules that are not required. Restrict local access to netfilter configuration and netlink sockets to trusted administrative accounts or services, and enforce least privilege. Monitor kernel logs for general protection faults or nfnetlink_log-related oopses and restart affected hosts after applying fixes.

Risk context

CVSS v3 is 5.5 (Medium) and no EPSS score is provided, so urgency is moderate rather than critical. Patch according to normal kernel update cadence, but prioritize systems where untrusted local users can interact with netfilter logging or where availability is critical.

Affected products

• Linux kernel
• Linux kernel netfilter nfnetlink_log
• Linux distributions shipping nfnetlink_log