HIGH Introduced in 4.12
netfilter NfnetlinkLog UAF
CVE-2026-93288
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state sashiko reports: "nfnl_log_net_exit() calls nf_log_unset(), which clears the logger pointer without an RCU grace period. Immediately after, ops_free_list() frees the per-net state while concurrent packets might still be executing nf_log_packet() under rcu_read_lock()." Clear the pointer via .pre_exit to make sure rcu readers have completed before pernet storage is free'd. The change in nf_log_syslog.c is only done for consistency: it doesn't use pernet data.
02KernelScan AI Analysis
Risk summary
A local attacker who can create network namespaces (e.g., via an unprivileged user namespace) can trigger a use-after-free in the netfilter logging subsystem during namespace teardown while packets are concurrently being logged. This can lead to kernel memory corruption, potentially enabling container escape or privilege escalation. The race window requires careful timing but is reachable without root privileges on default kernel configurations.
Vulnerability analysis
During network namespace teardown, the netfilter logging subsystem clears its logger pointer and immediately frees the per-namespace state without waiting for in-flight packet logging operations to finish. Packets being processed through netfilter hooks may still be reading that per-namespace data when it is freed, resulting in a use-after-free. The fix separates the logger shutdown from the memory release so the kernel waits for all concurrent readers to complete before the storage is freed. Any local user who can configure logging rules inside a user namespace — available to unprivileged containers by default — can reach this by generating traffic and tearing down the namespace concurrently.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 4.12 | 5.15.222 | ba2e246aa294 |
| 6.1 | 4.12 | 6.1.189 | 5570d6c8b320 |
| 6.12 | 4.12 | 6.12.111 | f44616543745 |
| 6.18 | 4.12 | 6.18.53 | dc20050b6b12 |
| 6.6 | 4.12 | 6.6.158 | 3b9aa62d78ce |
| mainline | 4.12 | 7.2 | 33d1469b0124 |
| cip/6.1 | 4.12 | 6.1.189-cip61 | 5570d6c8b320 |
| cip/6.1-rt | 4.12 | 6.1.189-cip61-rt32 | 5570d6c8b320 |
| cip/6.12 | 4.12 | 6.12.111-cip32 | f44616543745 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |
| cip/4.19 | Affected — no CIP fix yet (latest 4.19.325-cip136) |
| cip/4.19-rt | Affected — no CIP fix yet (latest 4.19.325-cip136-rt50) |