Live › vulnerability › CVE-2026-98624
Go to dashboardA race in the Linux kernel's nfnetlink_queue netfilter module lets a close() on a netlink socket run concurrently with an unbind request for the same port, causing a general protection fault. The sources describe a kernel oops; they do not state that code execution or privilege escalation is possible.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel with the nfnetlink_queue netfilter module loaded, where unprivileged or local processes can open netlink sockets and close them concurrently with unbind requests. Hosts that do not use NFQUEUE targets or nfqueue userspace programs are unlikely to load the module and can skip it.
No product ranges from the sources yet.
uname -r and compare against the kernel build that contains the upstream fix (the sources do not list fixed versions)lsmod | grep nfnetlink_queue to see whether the affected module is loadedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfnetlink_queue: hold nfnl mutex in event notifier
We must serialize the release notifier and the config netlink function. A concurrent thread can issue close() which can call the release function while unrelated socket processes UNBIND request for same portid:
Oops: general protection fault, [..] RIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue] Call Trace: nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue] nfnetlink_rcv_msg+0x7c2/0xeb0 ? __pfx_nfnetlink_rcv_msg+0x10/0x10
After this, parallel UNBIND and URELEASE events are impossible.
This change isn't nice, but its the shortest fix given instances are not refcounted and the nfnetlink config callback drops the rcu read lock early due to need for sleeping allocations.
This page as .md · .json · in your agent: get_signal("CVE-2026-98624")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.