{"id":"CVE-2026-97608","title":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_log: unregister loggers before per-net teardown\n\nnf_log_syslog and nfnetlink_log unregister their per-network namespace\noperations before unregistering th…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_log: unregister loggers before per-net teardown\n\nnf_log_syslog and nfnetlink_log unregister their per-network namespace\noperations before unregistering th…","severity":"high","cvss":7,"cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","vendor":"Linux","product":"Linux","affected":["Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e < eaec35fae8f2052c1878a5c7cc7699d8357d79f2","Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e < 64803ba0a05791cf9ca874466480e4c4cadaf7ab","Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e < dce24f3a146948595bb1b86347f31e20b4975daa","Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e < 2c018cc4842c33f0c732962e2ab58635e8ae5823","Linux 3.10"],"published":"2026-09-25","updated":"2026-09-25","sourceUpdated":"2026-09-25T15:18:01.110","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-97608","references":[{"url":"https://git.kernel.org/stable/c/2c018cc4842c33f0c732962e2ab58635e8ae5823","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/64803ba0a05791cf9ca874466480e4c4cadaf7ab","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/dce24f3a146948595bb1b86347f31e20b4975daa","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/eaec35fae8f2052c1878a5c7cc7699d8357d79f2","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"}],"tags":["nvd","cve.org"],"ingestedAt":"2026-09-25T11:06:38.900Z","slug":"CVE-2026-97608","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_log: unregister loggers before per-net teardown\n\nnf_log_syslog and nfnetlink_log unregister their per-network namespace\noperations before unregistering their global logger backends. This\nleaves a window where a sysctl or netlink writer can rebind the still-\nregistered logger after the per-net pre-exit callback cleared the old\nselection.\n\nThe race looks like this:\n\n  CPU 0                                 CPU 1\n  ----                                  ----\n  unregister_pernet_subsys()\n    nf_log_unset(net, logger)\n      net->nf.nf_loggers[pf] = NULL\n\n                                        lock nf_log_mutex\n                                        find logger in loggers[][]\n                                        net->nf.nf_loggers[pf] = logger\n                                        unlock nf_log_mutex\n\n  nf_log_unregister(logger)\n    lock nf_log_mutex\n    loggers[pf][type] = NULL\n    unlock nf_log_mutex\n    synchronize_rcu()\n  module exit returns\n  module core frees backend memory\n\nLater, a sysctl read or packet logging operation can dereference the\nstale per-net logger pointer.\n\nFix this by unregistering the global logger backends before tearing down\nper-net state. Once the global registrations are gone, later writers can\nno longer rebind the logger. unregister_pernet_subsys() already waits\nfor an RCU grace period after the pre-exit callback clears the per-net\nselection, while nf_log_unregister() continues to cover readers of the\nglobal logger table.\n\nApply this ordering fix to both nf_log backends that combine per-net\nteardown with global logger registration.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":39,"depthScoreParts":{"impact":38.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":210968,"id":"CVE-2026-97608","ts":1790349119807,"field":"cvss","old":null,"new":"7"},{"seq":210967,"id":"CVE-2026-97608","ts":1790349119807,"field":"severity","old":"none","new":"high"}]}