CVE-2026-74660

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebt_nflog: pin the NFLOG backend

nf_log_unregister() runs after the per-net teardown so its final RCU

grace period also drains readers that obtained the logger from a per-net

binding. However, ebt_nflog passes an explicit ULOG log type to

nf_log_packet() without holding a reference on the selected logger module,

unlike the xt_NFLOG and nft_log frontends.

An ebtables nflog rule can therefore remain callable while nfnetlink_log

is unloaded. The resulting interleaving is:

CPU 0 CPU 1

nfnetlink_log_fini()

unregister_pernet_subsys()

kfree(nfnl_log_pernet(net))

ebt_nflog_tg()

nf_log_packet()

nfulnl_log_packet()

instance_lookup_get_rcu()

The global ULOG logger is still registered at this point, so CPU 1

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References