CVE-2026-97608 netfilter: nf_log: unregister loggers before per-net teardown
A race condition in Linux kernel netfilter logging allows attackers to trigger use-after-free errors, potentially leading to code execution or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97608?
CVE-2026-97608 is a high-severity vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_log: unregister loggers before per-net teardown
nf_log_syslog and nfnetlink_log unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or netlink writer can rebind the still- registered logger after the per-net pre-exit callback cleared the old selection.
The race looks like this:
CPU 0 CPU 1 ---- ---- unregister_pernet_subsys() nf_log_unset(net, logger) net->nf.nf_loggers[pf] = NULL
lock nf_log_mutex find logger in loggers[][] net->nf.nf_loggers[pf] = logger unlock nf_log_mutex
nf_log_unregister(logger) lock nf_log_mutex loggers[pf][type] = NULL unlock nf_log_mutex synchronize_rcu() module exit returns module core frees backend memory
Later, a sysctl read or packet logging operation can dereference the stale per-net logger pointer.
Fix this by unregistering the global logger backends before tearing down per-net state. Once the global registrations are gone, later writers can no longer rebind the logger. unregister_pernet_subsys() already waits for an RCU grace period after the pre-exit callback clears the per-net selection, while nf_log_unregister() continues to cover readers of the global logger table.
Apply this ordering fix to both nf_log backends that combine per-net teardown with global logger registration.
Which versions are affected by CVE-2026-97608?
How do I fix CVE-2026-97608?
Apply the vendor's patch.
Is CVE-2026-97608 being exploited?
There is no known exploitation of CVE-2026-97608 in the wild and no public exploit code.
Sources
Also known as AZL-104738, BELL-CVE-2026-97608, DEBIAN-CVE-2026-97608, GHSA-gqgj-ww6j-qxj3, UBUNTU-CVE-2026-97608.