CVE-2026-97998

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_log: cope with concurrent instance destruction

Instances are refcounted. However, only memory release happens on the

1 -> 0 transition; the unlink from hashes can occur with any refcount.

Uncooperative userspace can force a situation where a queue is pending

for destruction from netlink event while a different socket with same

portid processes an UNBIND request.

With right timing, this will unhash the instance again:

Oops: general protection fault, [..]

Call Trace:

<TASK>

nfulnl_recv_config+0x31a/0xd50

nfnetlink_rcv_msg+0x7c2/0xeb0

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References