netfilter: ebt_nflog: pin the NFLOG backend

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74660
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-22 16:16:39 UTC
Updated2026-08-22 16:16:39 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module, unlike the xt_NFLOG and nft_log frontends. An ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving is: CPU 0 CPU 1 nfnetlink_log_fini() unregister_pernet_subsys() kfree(nfnl_log_pernet(net)) ebt_nflog_tg() nf_log_packet() nfulnl_log_packet() instance_lookup_get_rcu() The global ULOG logger is still registered at this point, so CPU 1 dereferences the per-net state after CPU 0 has freed it. KASAN reported: BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu Read of size 8 at addr ff110001052e6210 by task poc/92 Call Trace: instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log] nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log] nf_log_packet+0x204/0x300 ebt_nflog_tg+0x351/0x550 ebt_do_table+0xedf/0x22b0 Allocated by task 90: __kmalloc_noprof+0x186/0x470 ops_init+0x6d/0x420 register_pernet_operations+0x2f6/0x670 register_pernet_subsys+0x23/0x40 Freed by task 93: kfree+0x131/0x3c0 ops_undo_list+0x3e3/0x700 unregister_pernet_operations+0x232/0x490 unregister_pernet_subsys+0x1c/0x30 nfnetlink_log_fini+0x34/0x450 [nfnetlink_log] Acquire the ULOG logger module reference when an ebt_nflog rule is validated and release it when the rule is destroyed. Request the NFLOG backend for legacy callers when needed, matching xt_NFLOG. This prevents module teardown until all ebt_nflog rules have stopped using the logger.

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee 3bcce49d617c593c7606083bfdb464a1761fa68d git Not specified
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee 394d7939c6b2b9e6bea0844c89efb5913168d898 git Not specified
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee 2cac4294f184c9bc19ff82552c62b80498694c39 git Not specified
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee 9d8a94b48b393885e7f876c8ef68ed4da5012078 git Not specified
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee 6809379a860b9fccbb5435bf08343f6d081ac68d git Not specified
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee 47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb git Not specified
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee e2ab7e878bdbe80104c879c31fd2d82a476703b8 git Not specified
CNA Linux Linux affected c83fa19603bdaeef17b815713dbbe3230c8a34ee 30825970339c107bacaf7f61af90fcdb1f597ca1 git Not specified
CNA Linux Linux affected 4.12 Not specified
CNA Linux Linux unaffected 4.12 semver Not specified
CNA Linux Linux unaffected 5.10.265 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.216 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.183 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.152 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.104 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.45 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.9 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/3bcce49d617c593c7606083bfdb464a1761fa68d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/30825970339c107bacaf7f61af90fcdb1f597ca1 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/9d8a94b48b393885e7f876c8ef68ed4da5012078 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/6809379a860b9fccbb5435bf08343f6d081ac68d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/e2ab7e878bdbe80104c879c31fd2d82a476703b8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/394d7939c6b2b9e6bea0844c89efb5913168d898 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/2cac4294f184c9bc19ff82552c62b80498694c39 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report