HIGH Public exploit Introduced in 5.7
netfilter IDLETIMER Uninitialized
CVE-2026-23274
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI5.4MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels IDLETIMER revision 0 rules reuse existing timers by label and always call mod_timer() on timer->timer. If the label was created first by revision 1 with XT_IDLETIMER_ALARM, the object uses alarm timer semantics and timer->timer is never initialized. Reusing that object from revision 0 causes mod_timer() on an uninitialized timer_list, triggering debugobjects warnings and possible panic when panic_on_warn=1. Fix this by rejecting revision 0 rule insertion when an existing timer with the same label is of ALARM type.
02KernelScan AI Analysis
Risk summary
Local attackers, including unprivileged users via user namespaces, can trigger a kernel panic by inserting incompatible netfilter IDLETIMER revision 0 rules that reuse existing ALARM timer labels with uninitialized timer objects. This causes mod_timer() to be called on an uninitialized timer_list, resulting in debugobjects warnings and a kernel panic when panic_on_warn=1. The vulnerability is especially relevant for multi-tenant or container hosts where untrusted workloads can acquire CAP_NET_ADMIN.
Vulnerability analysis
The vulnerability occurs when netfilter IDLETIMER revision 0 rules attempt to reuse existing timer labels created by revision 1 with the XT_IDLETIMER_ALARM flag. Revision 1 alarm timers use alarm timer semantics and never initialize the timer->timer field, but revision 0 unconditionally calls mod_timer() on this field during rule insertion. This results in mod_timer() being called on an uninitialized timer_list structure, triggering debugobjects warnings and a potential kernel panic when panic_on_warn=1. The fix adds a check in idletimer_tg_checkentry() to reject revision 0 rule insertion when an existing timer with the same label is of ALARM type, preventing the dangerous timer reuse scenario.
Exploit availability
KernelScan found public exploit code for this CVE. Open it in the CVE browser to see what we found, where, and how strong the evidence is — that needs a free account with a confirmed email address.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 5.7 | 5.10.253 | 32e937dc6e97 |
| 5.15 | 5.7 | 5.15.203 | 144f88054ba0 |
| 6.1 | 5.7 | 6.1.167 | 28c7cfaf0c0a |
| 6.12 | 5.7 | 6.12.78 | 5e7ece24c5cb |
| 6.18 | 5.7 | 6.18.19 | f5ef97c13165 |
| 6.19 | 5.7 | 6.19.9 | f228b9ae2a7e |
| 6.6 | 5.7 | 6.6.130 | 540803559993 |
| mainline | 5.7 | 7.0 | 329f0b9b48ee |
| cip/5.10 | 5.7 | 5.10.254-cip72 | 32e937dc6e97 |
| cip/5.10-rt | 5.7 | 5.10.254-cip72-rt32 | 32e937dc6e97 |
| cip/6.1 | 5.7 | 6.1.167-cip53 | 28c7cfaf0c0a |
| cip/6.1-rt | 5.7 | 6.1.167-cip53-rt29 | 28c7cfaf0c0a |
| cip/6.12 | 5.7 | 6.12.78-cip19 | 5e7ece24c5cb |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.78-cip19 |
| cip/6.1 | Fixed in 6.1.167-cip53 |
| cip/6.1-rt | Fixed in 6.1.167-cip53-rt29 |
| cip/5.10 | Fixed in 5.10.254-cip72 |
| cip/5.10-rt | Fixed in 5.10.254-cip72-rt32 |