CVE-2026-74624

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: defer invalid log until after unlock

TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock

is still held.

When invalid logging is routed to nfnetlink_log and conntrack export is

enabled, the log path can re-enter conntrack netlink glue and dump the

same conntrack again. Protocol attribute dumping may take ct->lock, so

logging while holding that lock can deadlock.

Defer the TCP invalid logs by storing only the minimal log context while

ct->lock is held and emitting the log after unlocking. Also make the TCP

timeout-lowering invalid path return whether a log is needed, then emit

that log after unlocking.

Do the same for the SCTP invalid state-transition log that can be reached

while ct->lock is held.

Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers

that log invalid conntracks while holding ct->lock are caught outside TCP

and SCTP as well.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References