CVE-2026-98624

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

State: Published
Severity: Not scored
Published: Oct 18, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

We must serialize the release notifier and the config netlink function. A concurrent thread can issue close() which can call the release function while unrelated socket processes UNBIND request for same portid:

Oops: general protection fault, [..] RIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue] Call Trace: nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue] nfnetlink_rcv_msg+0x7c2/0xeb0 ? __pfx_nfnetlink_rcv_msg+0x10/0x10

After this, parallel UNBIND and URELEASE events are impossible.

This change isn't nice, but its the shortest fix given instances are not refcounted and the nfnetlink config callback drops the rcu read lock early due to need for sleeping allocations.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 46432f2e76f7c385d82506304a2928e7d293289fAffected 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 597320337c3da06c92a9e95cfc755da66fedc476Affected 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 2e9be1302f25c9be51c2fb8c907bc6d8a1050e33Affected 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before d559e06a5ab7c064100aafd5c826eadd0f1c6216Affected 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 1d1184411599a7c2217560bab3bbe641c6d03b95Affected 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 07a3ec8fdc5a1267c00cd6fd1cf8bbb5cda913c1Affected 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 8137a39e08e838ced234044384740ceeb99ed388Affected 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 9461613afc59acef44a0071b0dd5075f6e993ffeAffected
LinuxLinux	2.6.14Affected before 2.6.14Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 46432f2e76f7c385d82506304a2928e7d293289fAffected
7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 597320337c3da06c92a9e95cfc755da66fedc476Affected
7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 2e9be1302f25c9be51c2fb8c907bc6d8a1050e33Affected
7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before d559e06a5ab7c064100aafd5c826eadd0f1c6216Affected
7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 1d1184411599a7c2217560bab3bbe641c6d03b95Affected
7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 07a3ec8fdc5a1267c00cd6fd1cf8bbb5cda913c1Affected
7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 8137a39e08e838ced234044384740ceeb99ed388Affected
7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb to before 9461613afc59acef44a0071b0dd5075f6e993ffeAffected

LinuxLinux

2.6.14Affected
before 2.6.14Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.