All vulnerabilities
CVE-2026-98624

Linux: netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 6% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in46432f2e76f7c385d82506304a2928e7d293289fAlso 597320337c3da06c92a9e95cfc755da66fedc476, 2e9be1302f25c9be51c2fb8c907bc6d8a1050e33 and 4 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 46432f2e76f7c385d82506304a2928e7d293289fLinuxCVE List
  • 597320337c3da06c92a9e95cfc755da66fedc476LinuxCVE List
  • 2e9be1302f25c9be51c2fb8c907bc6d8a1050e33LinuxCVE List
  • 1d1184411599a7c2217560bab3bbe641c6d03b95LinuxCVE List
  • 07a3ec8fdc5a1267c00cd6fd1cf8bbb5cda913c1LinuxCVE List
  • 8137a39e08e838ced234044384740ceeb99ed388LinuxCVE List
Show all 7 fixed versions
  • 9461613afc59acef44a0071b0dd5075f6e993ffeLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

We must serialize the release notifier and the config netlink function. A concurrent thread can issue close() which can call the release function while unrelated socket processes UNBIND request for same portid:

Oops: general protection fault, [..] RIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue] Call Trace: nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue] nfnetlink_rcv_msg+0x7c2/0xeb0 ? __pfx_nfnetlink_rcv_msg+0x10/0x10

After this, parallel UNBIND and URELEASE events are impossible.

This change isn't nice, but its the shortest fix given instances are not refcounted and the nfnetlink config callback drops the rcu read lock early due to need for sleeping allocations.

Text from CVE List

Affected versions 18

  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before 46432f2e76f7c385d82506304a2928e7d293289fCVE List
  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before 597320337c3da06c92a9e95cfc755da66fedc476CVE List
  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before 2e9be1302f25c9be51c2fb8c907bc6d8a1050e33CVE List
  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before d559e06a5ab7c064100aafd5c826eadd0f1c6216CVE List
  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before 1d1184411599a7c2217560bab3bbe641c6d03b95CVE List
  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before 07a3ec8fdc5a1267c00cd6fd1cf8bbb5cda913c1CVE List
  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before 8137a39e08e838ced234044384740ceeb99ed388CVE List
  • Linuxaffected: 7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb before 9461613afc59acef44a0071b0dd5075f6e993ffeCVE List
  • Linuxaffected: 2.6.14CVE List
  • Linuxunaffected: all versions before 2.6.14CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8