{"id":"CVE-2026-98624","revision":"2efecef2f24e401b92b81ee6271062e7","records":[{"revision":"2efecef2f24e401b92b81ee6271062e7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98624","aliases":[],"title":"netfilter: nfnetlink_queue: hold nfnl mutex in event notifier","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: hold nfnl mutex in event notifier\n\nWe must serialize the release notifier and the config netlink function.\nA concurrent thread can issue close() which can call the release function\nwhile unrelated socket processes UNBIND request for same portid:\n\nOops: general protection fault, [..]\nRIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue]\nCall Trace:\n nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue]\n nfnetlink_rcv_msg+0x7c2/0xeb0\n ? __pfx_nfnetlink_rcv_msg+0x10/0x10\n\nAfter this, parallel UNBIND and URELEASE events are impossible.\n\nThis change isn't nice, but its the shortest fix given instances\nare not refcounted and the nfnetlink config callback drops the\nrcu read lock early due to need for sleeping allocations.","state":0,"publishedAt":"2026-10-18T15:19:45.566+00:00","modifiedAt":"2026-10-19T09:22:52.337+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nfnetlink_queue.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"46432f2e76f7c385d82506304a2928e7d293289f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"597320337c3da06c92a9e95cfc755da66fedc476\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"2e9be1302f25c9be51c2fb8c907bc6d8a1050e33\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"d559e06a5ab7c064100aafd5c826eadd0f1c6216\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"1d1184411599a7c2217560bab3bbe641c6d03b95\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"07a3ec8fdc5a1267c00cd6fd1cf8bbb5cda913c1\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"8137a39e08e838ced234044384740ceeb99ed388\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"7af4cc3fa158ff1dda6e7451c7e6afa6b0bb85cb\",\n                            \"lessThan\": \"9461613afc59acef44a0071b0dd5075f6e993ffe\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nfnetlink_queue.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.14\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.14\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/46432f2e76f7c385d82506304a2928e7d293289f","https://git.kernel.org/stable/c/597320337c3da06c92a9e95cfc755da66fedc476","https://git.kernel.org/stable/c/2e9be1302f25c9be51c2fb8c907bc6d8a1050e33","https://git.kernel.org/stable/c/d559e06a5ab7c064100aafd5c826eadd0f1c6216","https://git.kernel.org/stable/c/1d1184411599a7c2217560bab3bbe641c6d03b95","https://git.kernel.org/stable/c/07a3ec8fdc5a1267c00cd6fd1cf8bbb5cda913c1","https://git.kernel.org/stable/c/8137a39e08e838ced234044384740ceeb99ed388","https://git.kernel.org/stable/c/9461613afc59acef44a0071b0dd5075f6e993ffe"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98624","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98624","identifiers":["CVE-2026-98624"]},"retained":false,"historicalAffected":[]}],"coverage":[]}