{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-97609", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-24T16:01:01.158Z", "datePublished": "2026-09-25T10:22:19.627Z", "dateUpdated": "2026-09-25T14:41:32.080Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-09-25T14:41:32.080Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: prevent UAF during module unload\n\nnf_ct_set_timeout() protects the timeout hook dereference and policy lookup\nwith rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net\noperations before it clears the hook.\n\nThis allows the following interleaving:\n\n CPU 0 CPU 1\n cttimeout_exit() nf_ct_set_timeout()\n unregister_pernet_subsys() rcu_read_lock()\n kfree(pernet) h = nf_ct_timeout_hook\n h->timeout_find_get()\n nfct_timeout_pernet()\n\nThe hook still points to ctnl_timeout_find_get() when CPU 1 looks up the\nalready freed per-net timeout list. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get\n Read of size 8 by task poc/90\n Call Trace:\n ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]\n nf_ct_set_timeout+0x7b/0x3c0\n xt_ct_tg_check+0x724/0xb20\n xt_check_target+0x234/0xa90\n do_ipt_set_ctl+0x570/0x1270\n Allocated by task 89:\n __kmalloc_noprof+0x16e/0x460\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n Freed by task 91:\n kfree+0x131/0x390\n ops_undo_list+0x3d4/0x730\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]\n\nClear the hook and wait for existing readers before unregistering the\nper-net operations. This blocks new policy lookups and ensures readers that\nobserved the hook finish before the per-net storage is freed."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The reader that hits freed memory is reached only by a local setsockopt: do_ipt_set_ctl() -> xt_ct_tg_check() -> nf_ct_set_timeout() -> ctnl_timeout_find_get(), installing an iptables CT target with a timeout policy. No packet from a remote peer carries data into this path.\nAC:H - The free happens only when cttimeout_exit() runs, i.e. an admin unloading nfnetlink_cttimeout. The attacker must hit the short window between unregister_pernet_subsys() freeing the per-net list and RCU_INIT_POINTER(nf_ct_timeout_hook, NULL). An unprivileged attacker cannot cause that unload.\nPR:L - The racing side needs only CAP_NET_ADMIN over the netns, which an unprivileged user gets via unshare -Urn and then installs a CT --timeout rule through iptables set_ctl. The unload is the admin's action, not a privilege the attacker must hold.\nUI:N - No victim has to open, mount or run anything on the attacker's behalf. The attacker only needs to be running its setsockopt loop while the module unload happens (already counted in AC:H).\nS:U - The use-after-free is in kernel heap memory (the nfct_timeout_pernet list head) inside the same kernel security authority. No VM or hardware isolation boundary is crossed.\nC:H - ctnl_timeout_find_get() walks nfct_timeout_list inside the freed per-net storage. If that memory is reallocated with attacker data, the walk follows a fake list to a fake ctnl_timeout, and that pointer is returned to nf_ct_set_timeout(), enabling reads of kernel memory.\nI:H - Following a forged list entry, the code increments a refcount on the attacker-chosen object and stores the returned nf_ct_timeout pointer in the conntrack template's timeout extension. That gives a write primitive and a controlled object pointer that can be used for memory corruption.\nA:H - Dereferencing freed per-net memory in ctnl_timeout_find_get() produces a KASAN slab-use-after-free (shown in the fix commit), and on production kernels can oops or corrupt the heap and crash the system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nfnetlink_cttimeout.c"], "versions": [{"version": "ebfbe67568a734a449203097b02c4ab884257535", "lessThan": "a7fdd86c386b7f7cc72a126389c2cdb55d035221", "status": "affected", "versionType": "git"}, {"version": "ebfbe67568a734a449203097b02c4ab884257535", "lessThan": "1f69c570a73f2dedf75ea5166d47622d5fa958c1", "status": "affected", "versionType": "git"}, {"version": "ebfbe67568a734a449203097b02c4ab884257535", "lessThan": "fec9b1de0d02de8dafa3cc344bcb91cf28660643", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nfnetlink_cttimeout.c"], "versions": [{"version": "5.13", "status": "affected"}, {"version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.53", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.7", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3-rc3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.53"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.2.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.3-rc3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a7fdd86c386b7f7cc72a126389c2cdb55d035221"}, {"url": "https://git.kernel.org/stable/c/1f69c570a73f2dedf75ea5166d47622d5fa958c1"}, {"url": "https://git.kernel.org/stable/c/fec9b1de0d02de8dafa3cc344bcb91cf28660643"}], "title": "netfilter: cttimeout: prevent UAF during module unload", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nfnetlink_cttimeout.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a7fdd86c386b7f7cc72a126389c2cdb55d035221", "status": "affected", "version": "ebfbe67568a734a449203097b02c4ab884257535", "versionType": "git"}, {"lessThan": "1f69c570a73f2dedf75ea5166d47622d5fa958c1", "status": "affected", "version": "ebfbe67568a734a449203097b02c4ab884257535", "versionType": "git"}, {"lessThan": "fec9b1de0d02de8dafa3cc344bcb91cf28660643", "status": "affected", "version": "ebfbe67568a734a449203097b02c4ab884257535", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nfnetlink_cttimeout.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.13"}, {"lessThan": "5.13", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.53", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3-rc3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: prevent UAF during module unload\n\nnf_ct_set_timeout() protects the timeout hook dereference and policy lookup\nwith rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net\noperations before it clears the hook.\n\nThis allows the following interleaving:\n\n CPU 0 CPU 1\n cttimeout_exit() nf_ct_set_timeout()\n unregister_pernet_subsys() rcu_read_lock()\n kfree(pernet) h = nf_ct_timeout_hook\n h->timeout_find_get()\n nfct_timeout_pernet()\n\nThe hook still points to ctnl_timeout_find_get() when CPU 1 looks up the\nalready freed per-net timeout list. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get\n Read of size 8 by task poc/90\n Call Trace:\n ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]\n nf_ct_set_timeout+0x7b/0x3c0\n xt_ct_tg_check+0x724/0xb20\n xt_check_target+0x234/0xa90\n do_ipt_set_ctl+0x570/0x1270\n Allocated by task 89:\n __kmalloc_noprof+0x16e/0x460\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n Freed by task 91:\n kfree+0x131/0x390\n ops_undo_list+0x3d4/0x730\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]\n\nClear the hook and wait for existing readers before unregistering the\nper-net operations. This blocks new policy lookups and ensures readers that\nobserved the hook finish before the per-net storage is freed."}], "id": "CVE-2026-97609", "lastModified": "2026-09-25T15:18:01.247", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-09-25T11:17:14.987", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1f69c570a73f2dedf75ea5166d47622d5fa958c1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a7fdd86c386b7f7cc72a126389c2cdb55d035221"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fec9b1de0d02de8dafa3cc344bcb91cf28660643"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{}

{}