CVE-2026-97998 netfilter: nfnetlink_log: cope with concurrent instance destruction
A race condition in the Linux kernel netfilter logging module allows local attackers to trigger a general protection fault and system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-97998?
CVE-2026-97998 is a vulnerability in Linux, published on 25 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_log: cope with concurrent instance destruction
Instances are refcounted. However, only memory release happens on the 1 -> 0 transition; the unlink from hashes can occur with any refcount.
Uncooperative userspace can force a situation where a queue is pending for destruction from netlink event while a different socket with same portid processes an UNBIND request.
With right timing, this will unhash the instance again:
Oops: general protection fault, [..] Call Trace: <TASK> nfulnl_recv_config+0x31a/0xd50 nfnetlink_rcv_msg+0x7c2/0xeb0
Which versions are affected by CVE-2026-97998?
How do I fix CVE-2026-97998?
Apply the vendor's patch.
Is CVE-2026-97998 being exploited?
There is no known exploitation of CVE-2026-97998 in the wild and no public exploit code.
Sources
Also known as AZL-104364, BELL-CVE-2026-97998, DEBIAN-CVE-2026-97998, GHSA-42fg-rvg7-wwj2, UBUNTU-CVE-2026-97998.