CVE-2026-74660 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: ebt_nflog: pin the NFLOG backend
nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module, unlike the xt_NFLOG and nft_log frontends.
An ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving is:
CPU 0 CPU 1 nfnetlink_log_fini() unregister_pernet_subsys() kfree(nfnl_log_pernet(net)) ebt_nflog_tg() nf_log_packet() nfulnl_log_packet() instance_lookup_get_rcu()
The global ULOG logger is still registered at this point, so CPU 1 dereferences the per-net state after CPU 0 has freed it. KASAN reported:
BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu Read of size 8 at addr ff110001052e6210 by task poc/92 Call Trace: instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]
nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]
nf_log_packet+0x204/0x300 ebt_nflog_tg+0x351/0x550 ebt_do_table+0xedf/0x22b0 Allocated by task 90: __kmalloc_noprof+0x186/0x470 ops_init+0x6d/0x420 register_pernet_operations+0x2f6/0x670 register_pernet_subsys+0x23/0x40 Freed by task 93: kfree+0x131/0x3c0 ops_undo_list+0x3e3/0x700 unregister_pernet_operations+0x232/0x490 unregister_pernet_subsys+0x1c/0x30 nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]
Acquire the ULOG logger module reference when an ebt_nflog rule is validated and release it when the rule is destroyed. Request the NFLOG backend for legacy callers when needed, matching xt_NFLOG. This prevents module teardown until all ebt_nflog rules have stopped using the logger.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel vulnerability identified in the netfilter subsystem involves a use-after-free condition within the ebtables nflog target implementation. Specifically, the issue arises from an improper reference counting mechanism when handling network packet logging via the NFLOG backend. While other frontends such as xt_NFLOG and nft_log correctly acquire references to their respective logger modules before invoking logging functions, ebt_nflog fails to do so for explicit ULOG log types passed to nf_log_packet. This discrepancy creates a race condition during module teardown where the underlying per-net state can be freed while still being accessed by active ebtables rules.
The technical flaw centers on the lifecycle management of network namespace resources associated with netfilter logging. When the nfnetlink_log module is unloaded, it triggers a sequence involving unregister_pernet_subsys and subsequent memory deallocation via kfree for the per-net private data structures. However, because ebt_nflog does not hold a reference to the logger module during rule execution, there is no mechanism preventing the module from being removed while rules are still active. Consequently, if an ebtables rule invokes nf_log_packet after the per-net structure has been freed but before all RCU grace periods have completed, CPU threads may attempt to dereference invalid memory addresses. This leads to kernel panics or potential exploitation vectors where attackers could leverage the use-after-free condition for arbitrary code execution or denial of service.
From an operational impact perspective, this vulnerability allows local users with appropriate privileges to trigger a system crash by crafting specific ebtables rules and inducing module unloading scenarios. The KASAN report confirms slab-use-after-free errors in instance_lookup_get_rcu, indicating that the kernel attempts to read from memory that has already been returned to the allocator pool. This instability compromises system reliability and security posture, particularly in environments where dynamic loading and unloading of netfilter modules are common practices for network policy management.
To mitigate this vulnerability, developers must ensure that ebt_nflog acquires a reference count on the ULOG logger module when an ebtables rule is validated and releases it upon rule destruction. This approach mirrors the behavior implemented in xt_NFLOG and ensures that the NFLOG backend remains loaded until all associated rules have ceased using the logging infrastructure. By synchronizing module lifecycle with rule usage, the kernel prevents premature deallocation of per-net state structures. Security practitioners should apply relevant kernel patches promptly to resolve this reference counting deficiency and restore robustness to netfilter operations.
This vulnerability aligns with CWE-416 Use After Free, which describes situations where a program continues to use a pointer after it has been freed, leading to undefined behavior. Additionally, the exploitation potential relates to ATT&CK technique T1059 Command and Scripting Interpreter through indirect means if an attacker can manipulate network packet processing paths to trigger kernel crashes or escalate privileges via memory corruption. Proper implementation of reference counting mechanisms is critical for maintaining integrity in complex subsystems like netfilter where multiple components interact asynchronously across different execution contexts.