CVE-2026-97609 in Linux
Summary
by MITRE • 09/25/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: cttimeout: prevent UAF during module unload
nf_ct_set_timeout() protects the timeout hook dereference and policy lookup with rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net operations before it clears the hook.
This allows the following interleaving:
CPU 0 CPU 1 cttimeout_exit() nf_ct_set_timeout() unregister_pernet_subsys() rcu_read_lock() kfree(pernet) h = nf_ct_timeout_hook h->timeout_find_get() nfct_timeout_pernet()
The hook still points to ctnl_timeout_find_get() when CPU 1 looks up the already freed per-net timeout list. KASAN reported:
BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get Read of size 8 by task poc/90 Call Trace: ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]
nf_ct_set_timeout+0x7b/0x3c0 xt_ct_tg_check+0x724/0xb20 xt_check_target+0x234/0xa90 do_ipt_set_ctl+0x570/0x1270 Allocated by task 89: __kmalloc_noprof+0x16e/0x460 ops_init+0x6d/0x420 register_pernet_operations+0x2f6/0x670 Freed by task 91: kfree+0x131/0x390 ops_undo_list+0x3d4/0x730 unregister_pernet_operations+0x232/0x490 unregister_pernet_subsys+0x1c/0x30 cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]
Clear the hook and wait for existing readers before unregistering the per-net operations. This blocks new policy lookups and ensures readers that observed the hook finish before the per-net storage is freed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/25/2026
The Linux kernel vulnerability identified in the netfilter connection tracking timeout subsystem represents a critical use-after-free condition arising from improper synchronization during module unloading. The core of this issue lies in the ordering of operations within the cttimeout_exit function, which manages the cleanup of network namespace-specific data structures associated with connection tracking timeouts. Specifically, the exit routine was unregistering per-net operations before clearing the global timeout hook pointer. This sequence creates a race condition window where the system state is inconsistent: the hook remains registered and accessible to concurrent kernel threads, but the underlying memory it references has been marked for deallocation or freed entirely.
The technical flaw manifests through an interleaving execution scenario involving two distinct CPU cores operating in parallel. On one core, the cttimeout_exit function proceeds with unregistering per-net subsystems, which triggers the freeing of allocated network namespace structures via kfree. Simultaneously, on another core, a packet processing path invokes nf_ct_set_timeout to modify connection tracking parameters. This function acquires an RCU read lock and dereferences the timeout hook pointer to locate specific policy data. Because the hook was not cleared before the per-net memory was freed in the exit routine, CPU 1 accesses a dangling pointer that points to already released kernel slab memory. The KASAN report confirms this by detecting a slab-use-after-free error when attempting to read from ctnl_timeout_find_get, which relies on accessing these now-invalid network namespace structures.
From an operational impact perspective, this vulnerability allows for potential denial of service and arbitrary code execution scenarios depending on the attacker's ability to trigger module unload while concurrent connection tracking operations are active. The use-after-free condition can lead to kernel panics due to invalid memory access, effectively crashing the system. More severely, if an attacker can control the contents of the freed slab region through subsequent allocations, they may achieve arbitrary read or write primitives within kernel space. This bypasses standard user-space isolation boundaries and compromises the integrity of the entire operating system. The vulnerability is particularly dangerous because it occurs during module management operations, which might be triggered by privileged users or automated scripts managing network configurations, thereby expanding the attack surface beyond just packet processing paths.
This flaw aligns with CWE-416, Use After Free, as the code attempts to use a pointer after its memory has been freed. In terms of MITRE ATT&CK mapping for Linux systems, this vulnerability facilitates privilege escalation and defense evasion by allowing attackers to manipulate kernel state through race conditions during module lifecycle management. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, as the lack of proper locking or ordering between hook deregistration and memory deallocation allows unsafe concurrent access. The root cause is a failure in resource cleanup sequencing rather than a simple missing lock, highlighting the complexity of RCU-based synchronization in kernel subsystems where readers must be guaranteed to complete before writers free shared resources.
The mitigation implemented addresses this by altering the order of operations within cttimeout_exit. Instead of unregistering per-net operations first, the fix ensures that the timeout hook is cleared and a grace period for existing RCU readers is waited upon before any network namespace structures are freed. This guarantees that no new policy lookups can occur against the stale hook pointer and that all ongoing reads initiated by other CPUs have completed their execution cycles. By enforcing this strict ordering, the vulnerability is neutralized as the memory referenced by the hook remains valid until it is confirmed safe to deallocate. System administrators should ensure that kernel updates incorporating this fix are applied promptly, particularly in environments where netfilter modules are dynamically loaded and unloaded frequently or where network namespace configurations change often under concurrent load conditions.