« Volver al listado

CVE-2026-97998

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: cope with concurrent instance destruction

Instances are refcounted. However, only memory release happens on the 1 -> 0 transition; the unlink from hashes can occur with any refcount.

Uncooperative userspace can force a situation where a queue is pending for destruction from netlink event while a different socket with same portid processes an UNBIND request.

With right timing, this will unhash the instance again:

Detalles técnicos trazas, registros y código del informe original
Oops: general protection fault, [..]
Call Trace:
 <TASK>
 nfulnl_recv_config+0x31a/0xd50
 nfnetlink_rcv_msg+0x7c2/0xeb0

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-97998",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "c5c89beaa628d6ac527c6eb2e01b2b52eb417f59",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "042465e7d3d3127e21f04e42c1639e2518b98915",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "291685fc8d2e4cf75ed3a23c810883653f407f46",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "3161186a2ff81288e9a5f35daf1911153764ecae",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "0234d7ca0317be0a623300e1693cd794bbfdf8af",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "1a7a8ac9a9f0ad0d410c901cb6f233833518844c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "e2dd0f1f8c4e6334699ea6382e52f6da0c7e45eb",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0597f2680d666a3bcf101ac0c771ba7e50016bbd",
              "lessThan": "387d744fa7e499d2c3748a4e60e02ebb24e7fb16",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/netfilter/nfnetlink_log.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.14"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.14",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/netfilter/nfnetlink_log.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:28.107",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0234d7ca0317be0a623300e1693cd794bbfdf8af",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/042465e7d3d3127e21f04e42c1639e2518b98915",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1a7a8ac9a9f0ad0d410c901cb6f233833518844c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/291685fc8d2e4cf75ed3a23c810883653f407f46",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3161186a2ff81288e9a5f35daf1911153764ecae",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/387d744fa7e499d2c3748a4e60e02ebb24e7fb16",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/c5c89beaa628d6ac527c6eb2e01b2b52eb417f59",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e2dd0f1f8c4e6334699ea6382e52f6da0c7e45eb",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_log: cope with concurrent instance destruction\n\nInstances are refcounted. However, only memory release happens on the\n1 -> 0 transition; the unlink from hashes can occur with any refcount.\n\nUncooperative userspace can force a situation where a queue is pending\nfor destruction from netlink event while a different socket with same\nportid processes an UNBIND request.\n\nWith right timing, this will unhash the instance again:\n\nOops: general protection fault, [..]\nCall Trace:\n <TASK>\n nfulnl_recv_config+0x31a/0xd50\n nfnetlink_rcv_msg+0x7c2/0xeb0"
    }
  ],
  "lastModified": "2026-10-03T11:18:23.370",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}