CVE-2026-97608

A flaw was found in the Linux kernel's netfilter subsystem. A race condition occurs when network namespace operations are torn down before global logging backends are unregistered. A local user can exploit this timing window through sysctl or netlink interfaces to rebind a logger while it is being removed. This improper teardown sequence allows the kernel to access freed memory during subsequent logging operations, leading to a system crash and Denial of Service (DoS).

A race during nf_log_syslog or nfnetlink_log teardown can leave a stale per network logger pointer after the global backend and its module memory have been released. A sysctl or netlink writer can rebind the logger after the per network pre exit callback clears it but before nf_log_unregister removes the global registration. A later sysctl read or packet logging operation can dereference the freed backend and cause a kernel crash. The confirmed impact is at least local denial of service. Because the stale object contains logger backend data and callbacks, the worst case may include confidentiality and integrity impact if the freed target can be reused or influenced. For the CVSS the PR:L value is used for the paranoid score because a process with delegated CAP_NET_ADMIN, container root, or equivalent netfilter control may race module teardown performed by an administrator or system service. AC:H applies because successful triggering depends on a narrow timing window during module removal. The issue is not directly remotely reachable because network traffic alone cannot create the stale pointer, although packet logging can dereference it after the race has occurred.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.