---
id: "CVE-2026-98624"
kind: "vulnerability"
aliases: ["CVE-2026-98624"]
title: "Linux kernel: netfilter queue race can crash the kernel on socket close"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["infrastructure", "kernel", "linux", "netfilter", "self-hosted"]
not_affected_if: ["module-not-loaded", "no-nfqueue-use"]
published_at: "2026-10-18T16:17:15+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:12+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98624", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: netfilter queue race can crash the kernel on socket close

A race in the Linux kernel's nfnetlink_queue netfilter module lets a close() on a netlink socket run concurrently with an unbind request for the same port, causing a general protection fault. The sources describe a kernel oops; they do not state that code execution or privilege escalation is possible.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the kernel build that contains the upstream fix (the sources do not list fixed versions)
- `lsmod | grep nfnetlink_queue` to see whether the affected module is loaded
- unknown for other checks: the sources do not say

## Fix

- Update the Linux kernel to a distribution or upstream release that includes the nfnetlink_queue fix (exact version unknown from the sources)
- If the nfnetlink_queue module is not needed, unload it or blacklist it until patched (unknown from the sources, standard practice)

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98624

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nfnetlink_queue: hold nfnl mutex in event notifier

We must serialize the release notifier and the config netlink function.
A concurrent thread can issue close() which can call the release function
while unrelated socket processes UNBIND request for same portid:

Oops: general protection fault, [..]
RIP: 0010:__instance_destroy+0x60/0x210 [nfnetlink_queue]
Call Trace:
 nfqnl_recv_config+0x9b0/0xdc0 [nfnetlink_queue]
 nfnetlink_rcv_msg+0x7c2/0xeb0
 ? __pfx_nfnetlink_rcv_msg+0x10/0x10

After this, parallel UNBIND and URELEASE events are impossible.

This change isn't nice, but its the shortest fix given instances
are not refcounted and the nfnetlink config callback drops the
rcu read lock early due to need for sleeping allocations.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_