CVE-2026-97608

CVE CVE-2026-97608EUVD EUVD-2026-86739Published 2026-09-25T10:22:19.000ZLast changed 2026-09-25T14:41:31.000ZCVSS 7.0

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_log: unregister loggers before per-net teardown nf_log_syslog and nfnetlink_log unregister their per-network namespace operations before unregistering their global logger backends. This leaves a window where a sysctl or netlink writer can rebind the still- registered logger after the per-net pre-exit callback cleared the old selection. The race looks like this: CPU 0 CPU 1 ---- ---- unregister_pernet_subsys() nf_log_unset(net, logger) net->nf.nf_loggers[pf] = NULL lock nf_log_mutex find logger in loggers[][] net->nf.nf_loggers[pf] = logger unlock nf_log_mutex nf_log_unregister(logger) lock nf_log_mutex loggers[pf][type] = NULL unlock nf_log_mutex synchronize_rcu() module exit returns module core frees backend memory Later, a sysctl read or packet logging operation can dereference the stale per-net logger pointer. Fix this by unregistering the global logger backends before tearing down per-net state. Once the global registrations are gone, later writers can no longer rebind the logger. unregister_pernet_subsys() already waits for an RCU grace period after the pre-exit callback clears the per-net selection, while nf_log_unregister() continues to cover readers of the global logger table. Apply this ordering fix to both nf_log backends that combine per-net teardown with global logger registration.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux patch: 6.12.111; 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <2c018cc4842c33f0c732962e2ab58635e8ae5823; patch: 7.3-rc3; patch: 6.18.53; 3.10; 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <dce24f3a146948595bb1b86347f31e20b4975daa; 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <64803ba0a05791cf9ca874466480e4c4cadaf7ab; patch: 7.2.7; 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <eaec35fae8f2052c1878a5c7cc7699d8357d79f2; patch: 0

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.