CVE-2026-74624

A flaw was found in the Linux kernel's netfilter component. Specifically, the TCP and SCTP connection tracking (conntrack) paths can attempt to log invalid packets while a critical lock is still held. If invalid logging is routed to nfnetlink_log and conntrack export is enabled, this can lead to a deadlock, resulting in a Denial of Service (DoS) for the system.

TCP and SCTP conntrack paths can emit invalid packet logs while ct lock is still held. When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the logging path can re enter conntrack netlink dumping and try to take the same ct lock again, causing a deadlock. For the CVSS the PR:N is used because a remote sender can trigger packet processing without a local account when the vulnerable logging configuration is present. The issue is network reachable through crafted or malformed TCP or SCTP traffic, but exploitation requires non default logging and export conditions, so AC:H is used. Impact is denial of service due to lockup or stalled packet processing, with no supported confidentiality or integrity impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.