CVE-2026-74624: Linux Kernel Netfilter Conntrack DOS

CVE-2026-74624 Overview

CVE-2026-74624 is a high-severity locking flaw in the Linux kernel's netfilter connection tracking (nf_conntrack) subsystem. The TCP and SCTP conntrack paths emit invalid-packet logs while ct->lock is still held. When invalid logging is routed to nfnetlink_log with conntrack export enabled, the log path can re-enter the conntrack netlink glue and dump the same conntrack entry. Because protocol attribute dumping may acquire ct->lock, logging while already holding that lock can deadlock the kernel. The upstream fix defers TCP and SCTP invalid logs until after the lock is released and adds a lockdep assertion in nf_ct_l4proto_log_invalid() to catch future regressions.

Critical Impact
A remote, unauthenticated attacker can trigger a kernel deadlock by sending crafted TCP or SCTP traffic to a host running netfilter conntrack with invalid-log export enabled, resulting in a denial of service.

Affected Products

Linux kernel (mainline) with nf_conntrack enabled
Kernel builds using nfnetlink_log with conntrack export
Stable kernel branches referenced in the linked commits

Discovery Timeline

2026-08-22 - CVE-2026-74624 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74624

Vulnerability Analysis

The flaw resides in nf_conntrack protocol handlers for TCP and SCTP. Both handlers call nf_ct_l4proto_log_invalid() to record invalid packets while still holding ct->lock. When the system routes these logs through nfnetlink_log and conntrack export is enabled, the log path re-enters conntrack netlink code to dump the offending flow. That dump path traverses protocol attributes, which itself takes ct->lock. The result is a lock re-acquisition against a non-recursive lock on the same CPU context, producing a deadlock and stalling packet processing. This is a classic ordering violation and impacts availability of any host performing stateful firewalling under the affected configuration.

Root Cause

The root cause is emitting a log message from a code path that still holds ct->lock. Downstream logging can trigger ctnetlink to dump the same conntrack entry, and protocol attribute dumping subsequently attempts to acquire ct->lock a second time. The TCP timeout-lowering invalid path and the SCTP invalid state-transition path both exhibit this pattern, categorizing the issue as a Deadlock race condition.

Attack Vector

The vulnerability is reachable over the network. An attacker sends malformed or state-violating TCP or SCTP traffic across a Linux firewall or endpoint that has conntrack enabled, invalid logging routed to nfnetlink_log, and conntrack export active. Repeated invalid packets amplify the chance of triggering the deadlock, halting packet processing and producing a denial-of-service condition. No authentication, privilege, or user interaction is required.

No verified public exploit code is available. See the linked kernel commits for the technical fix details.

Detection Methods for CVE-2026-74624

Indicators of Compromise

Kernel soft-lockup or hung-task warnings referencing nf_conntrack, tcp_packet, sctp_packet, or nf_ct_l4proto_log_invalid.
Sudden loss of network throughput on stateful firewall hosts with nfnetlink_log enabled for conntrack invalid events.
Bursts of invalid TCP or SCTP packets logged prior to a stall.

Detection Strategies

Monitor dmesg and journal entries for lockdep splats or INFO: task ... blocked messages tied to conntrack code paths.
Correlate nfnetlink_log volume spikes against packet-processing latency on gateway hosts.
Inventory hosts using sysctl net.netfilter.nf_conntrack_log_invalid and check whether nfnetlink_log is a configured logger.

Monitoring Recommendations

Alert on kernel BUG, WARN, or hung_task events from network subsystems.
Track running kernel versions via configuration management and flag hosts missing the fix commits.
Baseline expected invalid conntrack log rates and alert on anomalies.

How to Mitigate CVE-2026-74624

Immediate Actions Required

Update to a Linux kernel that includes the upstream commits: 0424186, 2d19b95, 63853eb, 9480fcf, c0224327, and ca97360.
Reboot affected firewall and gateway hosts after patching to load the fixed kernel.
Audit exposure by identifying systems using conntrack invalid logging routed through nfnetlink_log.

Patch Information

The fix defers TCP and SCTP invalid logs by capturing a minimal log context while ct->lock is held and emitting the log after the lock is released. The TCP timeout-lowering invalid path now returns whether a log is needed, allowing the caller to emit it outside the critical section. A lockdep assertion added to nf_ct_l4proto_log_invalid() prevents future callers from logging while holding ct->lock. Apply the referenced stable kernel commits or upgrade to a distribution kernel that incorporates them.

Workarounds

Disable invalid packet logging by setting net.netfilter.nf_conntrack_log_invalid=0 until patching is complete.
Switch the netfilter log backend away from nfnetlink_log (for example, to nf_log_syslog) to break the re-entrant path.
Disable conntrack netlink export where operationally feasible to prevent the recursive dump.

bash

# Temporarily disable conntrack invalid logging until patched
sysctl -w net.netfilter.nf_conntrack_log_invalid=0

# Persist across reboot
echo 'net.netfilter.nf_conntrack_log_invalid = 0' > /etc/sysctl.d/99-cve-2026-74624.conf

# Verify current logger backend for netfilter
cat /proc/net/netfilter/nf_log