---
id: CVE-2026-97608
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_log: unregister loggers before per-net teardown

  nf_log_syslog and nfnetlink_log unregister their per-network namespace
  operations before unregistering th…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: nf_log: unregister loggers before per-net teardown

  nf_log_syslog and nfnetlink_log unregister their per-network namespace
  operations before unregistering th…
severity: high
cvss: 7
cvssVector: 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <
    eaec35fae8f2052c1878a5c7cc7699d8357d79f2
  - >-
    Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <
    64803ba0a05791cf9ca874466480e4c4cadaf7ab
  - >-
    Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <
    dce24f3a146948595bb1b86347f31e20b4975daa
  - >-
    Linux >= 5b023fc8d8e0997e0b7ea6506d243afd5478c96e <
    2c018cc4842c33f0c732962e2ab58635e8ae5823
  - Linux 3.10
published: '2026-09-25'
updated: '2026-09-25'
sourceUpdated: '2026-09-25T15:18:01.110'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-97608'
references:
  - url: 'https://git.kernel.org/stable/c/2c018cc4842c33f0c732962e2ab58635e8ae5823'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/64803ba0a05791cf9ca874466480e4c4cadaf7ab'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dce24f3a146948595bb1b86347f31e20b4975daa'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/eaec35fae8f2052c1878a5c7cc7699d8357d79f2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-25T11:06:38.900Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_log: unregister loggers before per-net teardown

nf_log_syslog and nfnetlink_log unregister their per-network namespace
operations before unregistering their global logger backends. This
leaves a window where a sysctl or netlink writer can rebind the still-
registered logger after the per-net pre-exit callback cleared the old
selection.

The race looks like this:

  CPU 0                                 CPU 1
  ----                                  ----
  unregister_pernet_subsys()
    nf_log_unset(net, logger)
      net->nf.nf_loggers[pf] = NULL

                                        lock nf_log_mutex
                                        find logger in loggers[][]
                                        net->nf.nf_loggers[pf] = logger
                                        unlock nf_log_mutex

  nf_log_unregister(logger)
    lock nf_log_mutex
    loggers[pf][type] = NULL
    unlock nf_log_mutex
    synchronize_rcu()
  module exit returns
  module core frees backend memory

Later, a sysctl read or packet logging operation can dereference the
stale per-net logger pointer.

Fix this by unregistering the global logger backends before tearing down
per-net state. Once the global registrations are gone, later writers can
no longer rebind the logger. unregister_pernet_subsys() already waits
for an RCU grace period after the pre-exit callback clears the per-net
selection, while nf_log_unregister() continues to cover readers of the
global logger table.

Apply this ordering fix to both nf_log backends that combine per-net
teardown with global logger registration.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.