Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()." Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-24T17:17:10.070Z",
  "pubdate": "2026-09-24T17:17:10.070Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel netfilter subsystem, specifically within nfnetlink_log.\nThe vulnerability arises from an insufficient synchronization mechanism during the teardown of per-network namespace state, resulting in a race condition.\nIf triggered, an attacker could potentially execute arbitrary code, cause a system crash (Denial of Service), or escalate privileges.\nThe flaw affects components utilizing nf_log_packet() concurrently with namespace destruction.\nSuccessful exploitation requires the ability to trigger a network namespace exit while active logging operations are ongoing, potentially via local user access or specific network traffic patterns.\nThis vulnerability poses a significant risk to system stability and security, as it allows for memory corruption within the kernel space.",
  "technicalDetails": "The root cause of this vulnerability is a race condition in the nfnetlink_log module's namespace exit path, nfnl_log_net_exit().\nWhen a network namespace is destroyed, nfnl_log_net_exit() invokes nf_log_unset(), which nullifies the logger pointer.\nHowever, this pointer clearance is performed without enforcing an RCU (Read-Copy-Update) grace period.\nConsequently, the subsequent execution of ops_free_list() deallocates the per-net state structures while other CPU cores might still be executing nf_log_packet() within an rcu_read_lock() critical section.\nBecause the logger pointer is cleared immediately without waiting for existing RCU readers to finish, the nf_log_packet() function may attempt to access the already-freed per-net data structure, leading to a use-after-free condition.\nThe attack flow involves: 1) Initializing a netfilter logging operation that registers a logger instance within a network namespace. 2) Forcing the destruction of the network namespace (e.g., via process exit or namespace teardown requests). 3) Simultaneously ensuring that packets are being processed through nf_log_packet() in the context of the exiting namespace. 4) The kernel proceeds to free the per-net structure while the reader is still active. 5) The reader accesses the dangling pointer, triggering a kernel panic or, in a sophisticated exploit, leveraging the freed memory region for control flow hijacking.\nThe vulnerable component is identified within the nfnetlink_log and nf_log_syslog modules. The absence of proper RCU synchronization during the transition of the netfilter log logger state directly permits the use-after-free.\nThe fix necessitates moving the logger pointer clearance to the .pre_exit callback. By utilizing .pre_exit, the kernel ensures that the logger is unregistered and the necessary RCU grace period is observed before the actual memory deallocation occurs in the subsequent teardown phases, thereby eliminating the race condition."
}