---
id: CVE-2026-23274
title: 'netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels

  IDLETIMER revision 0 rules reuse existing timers by label and always call
  mod_timer() on timer->timer.…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    32e937dc6e97f5ed3cdfe3fc0b2b19a05e23fa44
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    144f88054ba0180467356f40895bd660b5dceeec
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    28c7cfaf0c0ab17cbd7754092116fd1af45271f9
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    54080355999381fed4a26129579a5765bab87491
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    5e7ece24c5cb75a60402aad4d803c7898ea40aa9
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    f5ef97c13165542480a6ffdbe6f09f40bbb7cbf1
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    f228b9ae2a7e84d1153616d8e71c4236cb1f1309
  - >-
    Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 <
    329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf
  - Linux 5.7
published: '2026-03-20'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T08:45:17.896Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23274'
references:
  - url: 'https://git.kernel.org/stable/c/32e937dc6e97f5ed3cdfe3fc0b2b19a05e23fa44'
  - url: 'https://git.kernel.org/stable/c/144f88054ba0180467356f40895bd660b5dceeec'
  - url: 'https://git.kernel.org/stable/c/28c7cfaf0c0ab17cbd7754092116fd1af45271f9'
  - url: 'https://git.kernel.org/stable/c/54080355999381fed4a26129579a5765bab87491'
  - url: 'https://git.kernel.org/stable/c/5e7ece24c5cb75a60402aad4d803c7898ea40aa9'
  - url: 'https://git.kernel.org/stable/c/f5ef97c13165542480a6ffdbe6f09f40bbb7cbf1'
  - url: 'https://git.kernel.org/stable/c/f228b9ae2a7e84d1153616d8e71c4236cb1f1309'
  - url: 'https://git.kernel.org/stable/c/329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06372
ingestedAt: '2026-09-08T15:33:26.993Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels

IDLETIMER revision 0 rules reuse existing timers by label and always call
mod_timer() on timer->timer.

If the label was created first by revision 1 with XT_IDLETIMER_ALARM,
the object uses alarm timer semantics and timer->timer is never initialized.
Reusing that object from revision 0 causes mod_timer() on an uninitialized
timer_list, triggering debugobjects warnings and possible panic when
panic_on_warn=1.

Fix this by rejecting revision 0 rule insertion when an existing timer with
the same label is of ALARM type.

## Affected

- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < 32e937dc6e97f5ed3cdfe3fc0b2b19a05e23fa44`
- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < 144f88054ba0180467356f40895bd660b5dceeec`
- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < 28c7cfaf0c0ab17cbd7754092116fd1af45271f9`
- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < 54080355999381fed4a26129579a5765bab87491`
- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < 5e7ece24c5cb75a60402aad4d803c7898ea40aa9`
- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < f5ef97c13165542480a6ffdbe6f09f40bbb7cbf1`
- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < f228b9ae2a7e84d1153616d8e71c4236cb1f1309`
- `Linux >= 68983a354a655c35d3fb204489d383a2a051fda7 < 329f0b9b48ee6ab59d1ab72fef55fe8c6463a6cf`
- `Linux 5.7`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.