CVE-2026-98624 Overview
CVE-2026-98624 is a race condition in the Linux kernel's nfnetlink_queue subsystem within netfilter. The flaw stems from missing serialization between the release notifier and the configuration netlink callback. A concurrent thread invoking close() can trigger the release path while an unrelated socket processes an UNBIND request for the same portid, leading to a general protection fault in __instance_destroy. The kernel maintainers resolved the issue by holding the nfnl mutex in the event notifier, preventing parallel UNBIND and URELEASE events.
Critical Impact
Concurrent netlink operations against nfnetlink_queue instances can cause kernel memory corruption and system crashes, enabling local denial-of-service conditions.
Affected Products
- Linux kernel versions containing the vulnerable nfnetlink_queue implementation
- Distributions shipping the netfilter subsystem without the serialization fix
- Systems using NFQUEUE targets for userspace packet processing
Discovery Timeline
- 2026-10-18 - CVE-2026-98624 published to NVD
- 2026-10-19 - Last updated in NVD database
Technical Details for CVE-2026-98624
Vulnerability Analysis
The vulnerability is a race condition [CWE-362] in the Linux kernel's nfnetlink_queue module. The release notifier and the configuration netlink function can execute concurrently against the same queue instance. When a process closes a netlink socket, the release path invokes __instance_destroy to tear down the queue state. In parallel, another socket may issue a configuration UNBIND request for the same portid, which also attempts to destroy the instance.
Because nfnetlink_queue instances are not reference-counted, both paths may operate on a freed or partially freed instance. The resulting access produces a general protection fault with a call trace through nfqnl_recv_config and nfnetlink_rcv_msg. The fix serializes both paths by holding the nfnl mutex within the event notifier.
Root Cause
The root cause is missing mutual exclusion between the release notifier callback and the configuration netlink handler. The configuration callback drops the RCU read lock early because it requires sleeping allocations. This creates a window where the release notifier can free or re-initialize instance state concurrently. Without refcounting on instances, there is no safeguard against the parallel teardown and reconfiguration.
Attack Vector
A local attacker with permission to open netlink sockets and interact with nfnetlink_queue can trigger the race by issuing concurrent close() and UNBIND operations against instances sharing the same portid. Successful exploitation produces a kernel oops and system instability. The attack requires local access and the ability to perform netlink operations against the netfilter subsystem.
No verified exploitation code is publicly available. See the upstream commits in the references for the technical fix details.
Detection Methods for CVE-2026-98624
Indicators of Compromise
- Kernel oops messages referencing __instance_destroy+0x60/0x210 [nfnetlink_queue] in dmesg or /var/log/kern.log
- General protection fault entries with call traces through nfqnl_recv_config and nfnetlink_rcv_msg
- Unexpected system crashes or hangs on hosts running NFQUEUE-based userspace packet filters
Detection Strategies
- Audit running kernel versions against the fixed commits listed in the kernel.org references to identify unpatched hosts
- Monitor host telemetry for repeated kernel panics or soft lockups on systems using netfilter queue targets
- Track processes creating AF_NETLINK sockets with the NETLINK_NETFILTER protocol family for anomalous volume
Monitoring Recommendations
- Forward kernel ring buffer and journald events to a centralized logging platform for correlation of oops signatures
- Alert on repeated nfnetlink_queue call-trace patterns across multiple hosts
- Review workloads that heavily use NFQUEUE (such as suricata or custom userspace filters) for abnormal termination patterns
How to Mitigate CVE-2026-98624
Immediate Actions Required
- Apply the upstream kernel patches referenced in the kernel.org commits as soon as vendor-rebuilt kernels are available
- Inventory systems using nfnetlink_queue and prioritize patching hosts exposing NFQUEUE to untrusted local workloads
- Restrict local user access on multi-tenant systems until patched kernels are deployed
Patch Information
The fix serializes the release notifier and config netlink paths by holding the nfnl mutex in the event notifier. Mainline and stable kernel fixes are available in the following commits: 07a3ec8, 1d11844, 2e9be13, 46432f2, 5973203, 8137a39, 9461613, and d559e06.
Workarounds
- Reduce the attack surface by unloading the nfnetlink_queue module on systems that do not require NFQUEUE functionality
- Limit unprivileged user namespaces and netlink socket access via sysctl where operational requirements allow
- Apply mandatory access control policies (SELinux, AppArmor) to restrict which processes may interact with the netfilter netlink subsystem
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
