CVE-2026-97998

A flaw was found in the Linux kernel's netfilter subsystem. A race condition in the nfnetlink_log packet logging component allows a local user to trigger concurrent instance destruction by issuing an unbind request while a queue destruction event is pending. This issue leads to an invalid memory operation, causing a general protection fault and resulting in a Denial of Service (DoS) via a system crash.

A race condition flaw of moderate impact was found in the Linux kernel's netfilter nfnetlink_log packet logging component, which ships in the kernels of Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and the Red Hat CoreOS images used by Red Hat OpenShift Container Platform. Instances of nfnetlink_log are reference counted, but only the memory release is tied to the final reference; unlinking an instance from the hash lists can occur at any refcount. A local user able to issue netlink configuration requests can make a pending queue destruction event race with an UNBIND request issued from a different socket using the same portid, causing the instance to be unhashed a second time. This results in corrupted list state and a general protection fault, crashing the kernel and causing a local denial of service. The fix for this flaw is deferred for the affected Red Hat product streams because it is a local denial of service that requires privileged local access and precise timing to trigger; the residual risk is that such a local user can crash an affected system.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.