Improper locking in Linux kernel - CVE-2026-74624

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper lock handling in netfilter nf_conntrack TCP and SCTP invalid-packet logging when processing invalid packets while invalid logging is routed to nfnetlink_log and conntrack export is enabled. A remote attacker can send specially crafted packets to cause a denial of service.

The issue can deadlock when invalid-packet logging re-enters conntrack netlink glue and attempts to dump the same connection tracking entry again.

Affected software

How to mitigate CVE-2026-74624

External References

• https://git.kernel.org/stable/c/0424186d570aa4d1ad17f516afb86bd9eaa4f42e
• https://git.kernel.org/stable/c/2d19b95c9723001f214f7a47d67b09f46238f200
• https://git.kernel.org/stable/c/63853eb20bba4e00b7cd0b8cfc19337bbaaf5037
• https://git.kernel.org/stable/c/9480fcf70a5aa9d320088a01c95df0e5e6391f4a
• https://git.kernel.org/stable/c/c0224327b7cbed9d3198e8dbec847281053dcd06
• https://git.kernel.org/stable/c/ca97360eba4b3dc67f1804625542f4ccc774242a

Related Security Bulletins

• Improper locking in Linux kernel netfilter
• Debian update for linux