CVE-2026-97609

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: cttimeout: prevent UAF during module unload

nf_ct_set_timeout() protects the timeout hook dereference and policy lookup

with rcu_read_lock(). cttimeout_exit(), however, unregisters the per-net

operations before it clears the hook.

This allows the following interleaving:

CPU 0 CPU 1

cttimeout_exit() nf_ct_set_timeout()

unregister_pernet_subsys() rcu_read_lock()

kfree(pernet) h = nf_ct_timeout_hook

h->timeout_find_get()

nfct_timeout_pernet()

The hook still points to ctnl_timeout_find_get() when CPU 1 looks up the

already freed per-net timeout list. KASAN reported:

BUG: KASAN: slab-use-after-free in ctnl_timeout_find_get

Read of size 8 by task poc/90

Call Trace:

ctnl_timeout_find_get+0x271/0x2a0 [nfnetlink_cttimeout]

nf_ct_se

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References