CVE-2026-93288

A flaw was found in the Linux kernel's netfilter subsystem. When a network namespace is dismantled, the packet logging component frees memory without waiting for ongoing logging operations to complete, resulting in a use-after-free condition. A local attacker could exploit this flaw during network traffic processing to cause a system crash, leading to a Denial of Service (DoS), or potentially execute arbitrary code.

This vulnerability is rated as an Important severity flaw because an authenticated local user can trigger a use-after-free condition within kernel memory during network namespace cleanup, which could result in local privilege escalation or a complete kernel denial of service. Exploitation requires the ability to tear down network namespaces while active packet logging occurs, a scenario commonly reachable in environments permitting unprivileged user namespaces or multi-tenant container workloads. System deployments where container creation and user namespaces are strictly restricted to trusted administrators face significantly lower exposure to this issue.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Prevent the nfnetlink_log kernel module from being loaded by creating a configuration file:

echo "install nfnetlink_log /bin/true" > /etc/modprobe.d/disable-nfnetlink_log.conf

If the module is currently loaded, attempt to unload it:

modprobe -r nfnetlink_log

Caveats: If the module is in use, unloading it dynamically will fail, and a system reboot will be required for the configuration to take effect. Disabling nfnetlink_log prevents netfilter from logging packets via this netlink interface.