CVE-2026-74624 netfilter: nf_conntrack: defer invalid log until after unlock
A deadlock in the Linux kernel netfilter subsystem can cause a denial of service when invalid packet logging is enabled.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74624?
CVE-2026-74624 is a high-severity denial of service vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_conntrack: defer invalid log until after unlock
TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held.
When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct->lock, so logging while holding that lock can deadlock.
Defer the TCP invalid logs by storing only the minimal log context while ct->lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking.
Do the same for the SCTP invalid state-transition log that can be reached while ct->lock is held.
Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct->lock are caught outside TCP and SCTP as well.
Which versions are affected by CVE-2026-74624?
How do I fix CVE-2026-74624?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-74624 being exploited?
There is no known exploitation of CVE-2026-74624 in the wild and no public exploit code.
Sources
Also known as AZL-97152, BELL-CVE-2026-74624, DEBIAN-CVE-2026-74624, GHSA-3q82-j896-jqw7, UBUNTU-CVE-2026-74624.