CVE-2026-93288

netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

State: Published
Severity: 7.8 High
Published: Sep 24, 2026
Updated: Oct 3, 2026
Reserved: Sep 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state

sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()."

Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c83fa19603bdaeef17b815713dbbe3230c8a34ee to before ba2e246aa294f9acd86194ea87fb6834ed0a37acAffected c83fa19603bdaeef17b815713dbbe3230c8a34ee to before 5570d6c8b320dbcc602617ee08c27ce752fed65aAffected c83fa19603bdaeef17b815713dbbe3230c8a34ee to before 3b9aa62d78ce80de47af2db472ff452398755213Affected c83fa19603bdaeef17b815713dbbe3230c8a34ee to before f4461654374576e9d5d0245fd534c46ad8509051Affected c83fa19603bdaeef17b815713dbbe3230c8a34ee to before dc20050b6b12ca58066715d088e1a537535d938dAffected c83fa19603bdaeef17b815713dbbe3230c8a34ee to before 33d1469b0124cc0baaea7a2032123b77a81e0940Affected
LinuxLinux	4.12Affected before 4.12Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.111 through 6.12.Not affected 6.18.53 through 6.18.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

c83fa19603bdaeef17b815713dbbe3230c8a34ee to before ba2e246aa294f9acd86194ea87fb6834ed0a37acAffected
c83fa19603bdaeef17b815713dbbe3230c8a34ee to before 5570d6c8b320dbcc602617ee08c27ce752fed65aAffected
c83fa19603bdaeef17b815713dbbe3230c8a34ee to before 3b9aa62d78ce80de47af2db472ff452398755213Affected
c83fa19603bdaeef17b815713dbbe3230c8a34ee to before f4461654374576e9d5d0245fd534c46ad8509051Affected
c83fa19603bdaeef17b815713dbbe3230c8a34ee to before dc20050b6b12ca58066715d088e1a537535d938dAffected
c83fa19603bdaeef17b815713dbbe3230c8a34ee to before 33d1469b0124cc0baaea7a2032123b77a81e0940Affected

LinuxLinux

4.12Affected
before 4.12Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.111 through 6.12.*Not affected
6.18.53 through 6.18.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.