{"id":"CVE-2026-98624","kind":"vulnerability","aliases":["CVE-2026-98624"],"related":[],"title":"Linux kernel: netfilter queue race can crash the kernel on socket close","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nfnetlink_queue: hold nfnl mutex in event notifier\n\nWe must serialize the release notifier and the config netlink function.\nA concurrent thread can issue close() which can call the release function\nwhile unrelated socket processes UNBIND request for same portid:\n\nOops: general protection fault, [..]\nRIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue]\nCall Trace:\n nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue]\n nfnetlink_rcv_msg+0x7c2/0xeb0\n ? __pfx_nfnetlink_rcv_msg+0x10/0x10\n\nAfter this, parallel UNBIND and URELEASE events are impossible.\n\nThis change isn't nice, but its the shortest fix given instances\nare not refcounted and the nfnetlink config callback drops the\nrcu read lock early due to need for sleeping allocations.","summary":"A race in the Linux kernel's nfnetlink_queue netfilter module lets a close() on a netlink socket run concurrently with an unbind request for the same port, causing a general protection fault. The sources describe a kernel oops; they do not state that code execution or privilege escalation is possible.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","netfilter","self-hosted"],"not_affected_if":["module-not-loaded","no-nfqueue-use"],"how_to_check":"- `uname -r` and compare against the kernel build that contains the upstream fix (the sources do not list fixed versions)\n- `lsmod | grep nfnetlink_queue` to see whether the affected module is loaded\n- unknown for other checks: the sources do not say","fix":"- Update the Linux kernel to a distribution or upstream release that includes the nfnetlink_queue fix (exact version unknown from the sources)\n- If the nfnetlink_queue module is not needed, unload it or blacklist it until patched (unknown from the sources, standard practice)","status":"open","published_at":"2026-10-18T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:12+00:00","updated_at":"2026-10-25T05:21:12+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:21:12Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a distribution or upstream release that includes the nfnetlink_queue fix (exact version unknown from the sources)\n- If the nfnetlink_queue module is not needed, unload it or blacklist it until patched (unknown from the sources, standard practice)","reach":"local","title":"Linux kernel: netfilter queue race can crash the kernel on socket close","impact":"medium","summary":"A race in the Linux kernel's nfnetlink_queue netfilter module lets a close() on a netlink socket run concurrently with an unbind request for the same port, causing a general protection fault. The sources describe a kernel oops; they do not state that code execution or privilege escalation is possible.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","netfilter","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Kernel crashes from a general protection fault; code execution not stated by sources","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed versions, whether an unprivileged local user can trigger it, and whether it leads beyond a crash.","how_to_check":"- `uname -r` and compare against the kernel build that contains the upstream fix (the sources do not list fixed versions)\n- `lsmod | grep nfnetlink_queue` to see whether the affected module is loaded\n- unknown for other checks: the sources do not say","needs_analyst":true,"not_affected_if":["module-not-loaded","no-nfqueue-use"],"who_is_affected":"Systems running the Linux kernel with the nfnetlink_queue netfilter module loaded, where unprivileged or local processes can open netlink sockets and close them concurrently with unbind requests. Hosts that do not use NFQUEUE targets or nfqueue userspace programs are unlikely to load the module and can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000698,"input_tokens":3566,"output_tokens":683,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':136C,145C,152C,158C '-2026':14A,17A '-98624':15A,18A '0010':133C 'alloc':200C 'call':115C,140C 'callback':188C 'caus':54B 'chang':170C 'close':12A,39B,112C 'code':70B 'concurr':45B,108C 'config':104C,144C,187C 'crash':7A 'cve':13A,16A 'describ':61B 'destroy':135C 'drop':189C 'due':195C 'earli':194C 'escal':74B 'event':94C,166C 'execut':71B 'fault':58B,131C 'fix':178C 'follow':82C 'function':106C,118C 'general':56B,129C 'given':179C 'hold':90C 'host':25B 'imposs':168C 'infrastructur':19B 'instanc':134C,180C 'isn':171C 'issu':111C 'kernel':2A,9A,20B,31B,63B,80C 'let':37B 'linux':1A,21B,30B,79C 'lock':193C 'modul':36B 'msg':151C,157C 'must':97C 'mutex':92C 'need':197C 'netfilt':3A,22B,35B,87C 'netlink':42B,105C 'nfnetlink':33B,88C,138C,147C,149C,155C,186C 'nfnl':91C 'nfqnl':142C 'nice':173C 'notifi':95C,101C 'oop':64B,128C 'parallel':162C 'pfx':154C 'port':53B 'portid':127C 'possibl':76B 'privileg':73B 'process':122C 'protect':57B,130C 'queue':4A,34B,89C,139C,148C 'race':5A,27B 'rcu':191C 'rcv':150C,156C 'read':192C 'recv':143C 'refcount':183C 'releas':100C,117C 'request':49B,124C 'resolv':86C 'rip':132C 'run':44B 'self':24B 'self-host':23B 'serial':98C 'shortest':177C 'sleep':199C 'socket':11A,43B,121C 'sourc':60B 'state':68B 'thread':109C 'trace':141C 'unbind':48B,123C,163C 'unrel':120C 'ureleas':165C 'vulner':83C 'x10/0x10':159C 'x60/0x210':137C 'x7c2/0xeb0':153C 'x9b0/0xdc0':146C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the nfnetlink_queue netfilter module loaded, where unprivileged or local processes can open netlink sockets and close them concurrently with unbind requests. Hosts that do not use NFQUEUE targets or nfqueue userspace programs are unlikely to load the module and can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98624","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98624","severity":null,"published_at":"2026-10-18T16:17:15+00:00","modified_at":"2026-10-19T10:19:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}