CVE-2026-74660: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74660 Overview

CVE-2026-74660 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically in the ebt_nflog ebtables target. The flaw arises because ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module. When nfnetlink_log is unloaded, its per-net state is freed while active ebtables NFLOG rules can still call into it. A local, low-privileged attacker with the ability to trigger ebtables NFLOG rule execution during module teardown can dereference freed memory, leading to memory corruption, information disclosure, or local privilege escalation.

Critical Impact
Local attackers can trigger a slab use-after-free in the nfnetlink_log module through ebtables NFLOG rules, enabling potential kernel memory corruption and privilege escalation.

Affected Products

Linux kernel builds with CONFIG_BRIDGE_EBT_NFLOG and CONFIG_NETFILTER_NETLINK_LOG enabled
Distributions shipping the Linux kernel netfilter nfnetlink_log backend as a loadable module
Systems permitting user-namespace or CAP_NET_ADMIN access sufficient to install ebtables NFLOG rules

Discovery Timeline

2026-08-22 - CVE-2026-74660 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74660

Vulnerability Analysis

The vulnerability is a slab use-after-free in the netfilter logging path. nf_log_unregister() executes after the per-net teardown, so its final RCU grace period only drains readers that obtained the logger through a per-net binding. The ebt_nflog frontend bypasses that assumption by passing an explicit ULOG log type directly to nf_log_packet() without pinning the logger module. Unlike xt_NFLOG and nft_log, which take a reference on the backend, ebtables rules remain callable after nfnetlink_log_fini() frees the per-net state.

The reported KASAN interleaving shows CPU 0 executing nfnetlink_log_fini() and calling kfree(nfnl_log_pernet(net)), while CPU 1 concurrently runs ebt_nflog_tg() → nf_log_packet() → nfulnl_log_packet() → instance_lookup_get_rcu(). Because the global ULOG logger is still registered, CPU 1 dereferences the freed per-net structure, producing a slab-use-after-free read of 8 bytes at the freed instance.

Root Cause

The root cause is missing module reference counting in ebt_nflog. Legacy ebtables NFLOG callers never requested the NFLOG backend nor acquired the logger module reference during rule validation, allowing nfnetlink_log to be torn down while rules remained live.

Attack Vector

Exploitation requires local access with the ability to configure ebtables rules, typically CAP_NET_ADMIN in a network namespace. An attacker installs an ebtables rule using the NFLOG target, then triggers unloading of nfnetlink_log (or namespace teardown) while packets continue to match the rule. The race between nfnetlink_log_fini() and ebt_nflog_tg() frees the per-net logger state that the packet path still dereferences.

No public proof-of-concept beyond the KASAN report in the commit message is available. See the upstream fix commit for technical details of the corrected reference counting.

Detection Methods for CVE-2026-74660

Indicators of Compromise

Kernel KASAN reports citing slab-use-after-free in instance_lookup_get_rcu with call traces through nfulnl_log_packet and ebt_nflog_tg
Unexpected kernel oops or panic messages referencing nfnetlink_log following module unload or network namespace destruction
Unusual load/unload cycles of the nfnetlink_log kernel module on multi-tenant hosts

Detection Strategies

Enable KASAN or KFENCE on test kernels to surface the use-after-free during fuzzing of ebtables NFLOG paths
Audit ebtables rulesets across network namespaces for use of the NFLOG target combined with dynamic module loading
Correlate kmod and modprobe telemetry with ebtables configuration changes to identify race conditions

Monitoring Recommendations

Forward kernel ring buffer (dmesg) and /var/log/kern.log entries to a central log platform and alert on KASAN, BUG, or Oops signatures involving nfnetlink_log
Track auditd events for CAP_NET_ADMIN usage inside unprivileged user namespaces, which is a prerequisite for exploitation
Monitor kernel module load/unload events (init_module, delete_module) on production hosts

How to Mitigate CVE-2026-74660

Immediate Actions Required

Apply the stable-tree kernel updates containing the ebt_nflog reference-counting fix and reboot affected hosts
Disable or blacklist the ebt_nflog module on systems that do not require ebtables logging until patches are deployed
Restrict CAP_NET_ADMIN inside unprivileged user namespaces via sysctl kernel.unprivileged_userns_clone=0 or equivalent controls

Patch Information

The fix acquires the ULOG logger module reference when an ebt_nflog rule is validated and releases it when the rule is destroyed, and requests the NFLOG backend for legacy callers, matching xt_NFLOG behavior. Corresponding stable commits include 2cac4294, 30825970, 394d7939, 3bcce49d, 47a119ec, 6809379a, 9d8a94b4, and e2ab7e87.

Workarounds

Prevent loading of the ebt_nflog module by adding install ebt_nflog /bin/true to /etc/modprobe.d/
Remove any existing ebtables rules using the NFLOG target and rely on xt_NFLOG or nft log instead, which correctly pin the backend
Avoid unloading nfnetlink_log on hosts where ebtables NFLOG rules may still be active

bash

# Configuration example
# Blacklist ebt_nflog until the kernel is patched
echo 'install ebt_nflog /bin/true' | sudo tee /etc/modprobe.d/disable-ebt_nflog.conf

# Verify the module is not currently loaded
lsmod | grep -E 'ebt_nflog|nfnetlink_log'

# Enumerate ebtables rules using NFLOG across namespaces
sudo ebtables -L --Lc | grep -i nflog