{"api_version":"1","generated_at":"2026-10-01T19:17:13+00:00","cve":"CVE-2026-97609","urls":{"html":"https://cve.report/CVE-2026-97609","api":"https://cve.report/api/cve/CVE-2026-97609.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-97609","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-97609"},"summary":{"title":"netfilter: cttimeout: prevent UAF during module unload","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: prevent UAF during module unload\n\nnf_ct_set_timeout() protects the timeout hook dereference and policy lookup\nwith rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net\noperations before it clears the hook.\n\nThis allows the following interleaving:\n\n  CPU 0                              CPU 1\n  cttimeout_exit()                   nf_ct_set_timeout()\n    unregister_pernet_subsys()         rcu_read_lock()\n      kfree(pernet)                     h = nf_ct_timeout_hook\n                                        h->timeout_find_get()\n                                          nfct_timeout_pernet()\n\nThe hook still points to ctnl_timeout_find_get() when CPU 1 looks up the\nalready freed per-net timeout list. KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get\n  Read of size 8 by task poc/90\n  Call Trace:\n   ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]\n   nf_ct_set_timeout+0x7b/0x3c0\n   xt_ct_tg_check+0x724/0xb20\n   xt_check_target+0x234/0xa90\n   do_ipt_set_ctl+0x570/0x1270\n  Allocated by task 89:\n   __kmalloc_noprof+0x16e/0x460\n   ops_init+0x6d/0x420\n   register_pernet_operations+0x2f6/0x670\n  Freed by task 91:\n   kfree+0x131/0x390\n   ops_undo_list+0x3d4/0x730\n   unregister_pernet_operations+0x232/0x490\n   unregister_pernet_subsys+0x1c/0x30\n   cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]\n\nClear the hook and wait for existing readers before unregistering the\nper-net operations. This blocks new policy lookups and ensures readers that\nobserved the hook finish before the per-net storage is freed.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-25 11:17:14","updated_at":"2026-09-25 15:18:01"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/1f69c570a73f2dedf75ea5166d47622d5fa958c1","name":"https://git.kernel.org/stable/c/1f69c570a73f2dedf75ea5166d47622d5fa958c1","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/a7fdd86c386b7f7cc72a126389c2cdb55d035221","name":"https://git.kernel.org/stable/c/a7fdd86c386b7f7cc72a126389c2cdb55d035221","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/fec9b1de0d02de8dafa3cc344bcb91cf28660643","name":"https://git.kernel.org/stable/c/fec9b1de0d02de8dafa3cc344bcb91cf28660643","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-97609","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97609","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ebfbe67568a734a449203097b02c4ab884257535 a7fdd86c386b7f7cc72a126389c2cdb55d035221 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ebfbe67568a734a449203097b02c4ab884257535 1f69c570a73f2dedf75ea5166d47622d5fa958c1 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected ebfbe67568a734a449203097b02c4ab884257535 fec9b1de0d02de8dafa3cc344bcb91cf28660643 git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.13","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.13 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 6.18.53 6.18.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.7 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc3 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"97609","cve":"CVE-2026-97609","epss":"0.001390000","percentile":"0.026870000","score_date":"2026-09-27","updated_at":"2026-09-28 00:02:23"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/netfilter/nfnetlink_cttimeout.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"a7fdd86c386b7f7cc72a126389c2cdb55d035221","status":"affected","version":"ebfbe67568a734a449203097b02c4ab884257535","versionType":"git"},{"lessThan":"1f69c570a73f2dedf75ea5166d47622d5fa958c1","status":"affected","version":"ebfbe67568a734a449203097b02c4ab884257535","versionType":"git"},{"lessThan":"fec9b1de0d02de8dafa3cc344bcb91cf28660643","status":"affected","version":"ebfbe67568a734a449203097b02c4ab884257535","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["net/netfilter/nfnetlink_cttimeout.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.13"},{"lessThan":"5.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.53","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.7","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc3","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"6.18.53","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.7","versionStartIncluding":"5.13","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc3","versionStartIncluding":"5.13","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: prevent UAF during module unload\n\nnf_ct_set_timeout() protects the timeout hook dereference and policy lookup\nwith rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net\noperations before it clears the hook.\n\nThis allows the following interleaving:\n\n  CPU 0                              CPU 1\n  cttimeout_exit()                   nf_ct_set_timeout()\n    unregister_pernet_subsys()         rcu_read_lock()\n      kfree(pernet)                     h = nf_ct_timeout_hook\n                                        h->timeout_find_get()\n                                          nfct_timeout_pernet()\n\nThe hook still points to ctnl_timeout_find_get() when CPU 1 looks up the\nalready freed per-net timeout list. KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get\n  Read of size 8 by task poc/90\n  Call Trace:\n   ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]\n   nf_ct_set_timeout+0x7b/0x3c0\n   xt_ct_tg_check+0x724/0xb20\n   xt_check_target+0x234/0xa90\n   do_ipt_set_ctl+0x570/0x1270\n  Allocated by task 89:\n   __kmalloc_noprof+0x16e/0x460\n   ops_init+0x6d/0x420\n   register_pernet_operations+0x2f6/0x670\n  Freed by task 91:\n   kfree+0x131/0x390\n   ops_undo_list+0x3d4/0x730\n   unregister_pernet_operations+0x232/0x490\n   unregister_pernet_subsys+0x1c/0x30\n   cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]\n\nClear the hook and wait for existing readers before unregistering the\nper-net operations. This blocks new policy lookups and ensures readers that\nobserved the hook finish before the per-net storage is freed."}],"metrics":[{"cvssV3_1":{"baseScore":7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The reader that hits freed memory is reached only by a local setsockopt: do_ipt_set_ctl() -> xt_ct_tg_check() -> nf_ct_set_timeout() -> ctnl_timeout_find_get(), installing an iptables CT target with a timeout policy. No packet from a remote peer carries data into this path.\nAC:H - The free happens only when cttimeout_exit() runs, i.e. an admin unloading nfnetlink_cttimeout. The attacker must hit the short window between unregister_pernet_subsys() freeing the per-net list and RCU_INIT_POINTER(nf_ct_timeout_hook, NULL). An unprivileged attacker cannot cause that unload.\nPR:L - The racing side needs only CAP_NET_ADMIN over the netns, which an unprivileged user gets via unshare -Urn and then installs a CT --timeout rule through iptables set_ctl. The unload is the admin's action, not a privilege the attacker must hold.\nUI:N - No victim has to open, mount or run anything on the attacker's behalf. The attacker only needs to be running its setsockopt loop while the module unload happens (already counted in AC:H).\nS:U - The use-after-free is in kernel heap memory (the nfct_timeout_pernet list head) inside the same kernel security authority. No VM or hardware isolation boundary is crossed.\nC:H - ctnl_timeout_find_get() walks nfct_timeout_list inside the freed per-net storage. If that memory is reallocated with attacker data, the walk follows a fake list to a fake ctnl_timeout, and that pointer is returned to nf_ct_set_timeout(), enabling reads of kernel memory.\nI:H - Following a forged list entry, the code increments a refcount on the attacker-chosen object and stores the returned nf_ct_timeout pointer in the conntrack template's timeout extension. That gives a write primitive and a controlled object pointer that can be used for memory corruption.\nA:H - Dereferencing freed per-net memory in ctnl_timeout_find_get() produces a KASAN slab-use-after-free (shown in the fix commit), and on production kernels can oops or corrupt the heap and crash the system."}]}],"providerMetadata":{"dateUpdated":"2026-09-25T14:41:32.080Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/a7fdd86c386b7f7cc72a126389c2cdb55d035221"},{"url":"https://git.kernel.org/stable/c/1f69c570a73f2dedf75ea5166d47622d5fa958c1"},{"url":"https://git.kernel.org/stable/c/fec9b1de0d02de8dafa3cc344bcb91cf28660643"}],"title":"netfilter: cttimeout: prevent UAF during module unload","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-97609","datePublished":"2026-09-25T10:22:19.627Z","dateReserved":"2026-09-24T16:01:01.158Z","dateUpdated":"2026-09-25T14:41:32.080Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-25 11:17:14","lastModifiedDate":"2026-09-25 15:18:01","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"HIGH","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"97609","Ordinal":"1","Title":"netfilter: cttimeout: prevent UAF during module unload","CVE":"CVE-2026-97609","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"97609","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: prevent UAF during module unload\n\nnf_ct_set_timeout() protects the timeout hook dereference and policy lookup\nwith rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net\noperations before it clears the hook.\n\nThis allows the following interleaving:\n\n  CPU 0                              CPU 1\n  cttimeout_exit()                   nf_ct_set_timeout()\n    unregister_pernet_subsys()         rcu_read_lock()\n      kfree(pernet)                     h = nf_ct_timeout_hook\n                                        h->timeout_find_get()\n                                          nfct_timeout_pernet()\n\nThe hook still points to ctnl_timeout_find_get() when CPU 1 looks up the\nalready freed per-net timeout list. KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get\n  Read of size 8 by task poc/90\n  Call Trace:\n   ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]\n   nf_ct_set_timeout+0x7b/0x3c0\n   xt_ct_tg_check+0x724/0xb20\n   xt_check_target+0x234/0xa90\n   do_ipt_set_ctl+0x570/0x1270\n  Allocated by task 89:\n   __kmalloc_noprof+0x16e/0x460\n   ops_init+0x6d/0x420\n   register_pernet_operations+0x2f6/0x670\n  Freed by task 91:\n   kfree+0x131/0x390\n   ops_undo_list+0x3d4/0x730\n   unregister_pernet_operations+0x232/0x490\n   unregister_pernet_subsys+0x1c/0x30\n   cttimeout_exit+0x52/0x970 [nfnetlink_cttimeout]\n\nClear the hook and wait for existing readers before unregistering the\nper-net operations. This blocks new policy lookups and ensures readers that\nobserved the hook finish before the per-net storage is freed.","Type":"Description","Title":"netfilter: cttimeout: prevent UAF during module unload"}]}}}