CVE-2026-23274

A flaw was found in the Linux kernel's netfilter: xt_IDLETIMER module. This vulnerability occurs when revision 0 rules attempt to reuse a timer label previously created by revision 1 with alarm timer semantics. This action can lead to calling mod_timer() on an uninitialized timer list. A local attacker could potentially trigger debug object warnings and, under certain configurations, cause a kernel panic, leading to a Denial of Service (DoS).

A denial of service condition exists in xt_IDLETIMER when a revision 0 rule reuses a timer label that was originally created by revision 1 with XT_IDLETIMER_ALARM. In that mixed revision case the reused object follows ALARM semantics and the embedded timer_list field is never initialized. A subsequent revision 0 rule insertion or replacement will still call mod_timer on the uninitialized timer_list, which triggers debugobjects warnings and can escalate to a kernel panic when panic_on_warn is enabled. The issue is not network reachable and requires local control plane access to netfilter rule management. Impact is denial of service via system crash rather than information disclosure or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.