CVE-2026-74624

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74624", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.921Z", "datePublished": "2026-08-22T15:32:07.193Z", "dateUpdated": "2026-10-16T19:06:02.842Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:47.114Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock\nis still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is\nenabled, the log path can re-enter conntrack netlink glue and dump the\nsame conntrack again. Protocol attribute dumping may take ct->lock, so\nlogging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while\nct->lock is held and emitting the log after unlocking. Also make the TCP\ntimeout-lowering invalid path return whether a log is needed, then emit\nthat log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached\nwhile ct->lock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers\nthat log invalid conntracks while holding ct->lock are caught outside TCP\nand SCTP as well."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is hit in nf_conntrack_tcp_packet()/nf_conntrack_sctp_packet() from the NF_INET_PRE_ROUTING and LOCAL_OUT netfilter hooks on received or forwarded TCP/SCTP traffic, so a remote peer can trigger invalid conntrack handling with crafted packets to internet-facing NAT gateways, routers, and servers.\nAC:L - Once nf_conntrack_log_invalid, nflog binding, and NFULNL_CFG_F_CONNTRACK are enabled (the CVE-scoped configuration on monitored firewalls), an attacker deterministically deadlocks by sending invalid-sequence TCP or invalid-state SCTP packets on tracked flows without races or special memory layout.\nPR:N - Triggering the vulnerable conntrack path requires only the ability to send TCP/SCTP packets to a host already running connection tracking with invalid logging; no local account, CAP_NET_ADMIN, or netlink configuration privileges are needed on the attacker side.\nUI:N - Exploitation is driven entirely by network packet delivery and softirq packet processing; no victim must open files, mount filesystems, or perform any interactive action beyond normal network connectivity to the target.\nS:U - The deadlock confines impact to the same kernel networking authority processing the packet; it does not cross VM, container, or IOMMU boundaries to compromise a separate security domain.\nC:N - This is a recursive spinlock deadlock in conntrack invalid logging with no memory corruption, out-of-bounds access, use-after-free, or information-disclosure primitive.\nI:N - The bug causes a lock re-entry hang during logging only; it does not modify kernel or user data, provide arbitrary write primitives, or enable code execution.\nA:H - Re-acquiring ct->lock while it is held deadlocks packet processing on the affected CPU in softirq context, can stall networking on that core, and may escalate to soft lockup or watchdog-induced kernel panic under sustained attack."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conntrack_proto.c", "net/netfilter/nf_conntrack_proto_sctp.c", "net/netfilter/nf_conntrack_proto_tcp.c"], "versions": [{"version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "ca97360eba4b3dc67f1804625542f4ccc774242a", "status": "affected", "versionType": "git"}, {"version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "63853eb20bba4e00b7cd0b8cfc19337bbaaf5037", "status": "affected", "versionType": "git"}, {"version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "9480fcf70a5aa9d320088a01c95df0e5e6391f4a", "status": "affected", "versionType": "git"}, {"version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "0424186d570aa4d1ad17f516afb86bd9eaa4f42e", "status": "affected", "versionType": "git"}, {"version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "c0224327b7cbed9d3198e8dbec847281053dcd06", "status": "affected", "versionType": "git"}, {"version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "2d19b95c9723001f214f7a47d67b09f46238f200", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/netfilter/nf_conntrack_proto.c", "net/netfilter/nf_conntrack_proto_sctp.c", "net/netfilter/nf_conntrack_proto_tcp.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.184", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.184"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/ca97360eba4b3dc67f1804625542f4ccc774242a"}, {"url": "https://git.kernel.org/stable/c/63853eb20bba4e00b7cd0b8cfc19337bbaaf5037"}, {"url": "https://git.kernel.org/stable/c/9480fcf70a5aa9d320088a01c95df0e5e6391f4a"}, {"url": "https://git.kernel.org/stable/c/0424186d570aa4d1ad17f516afb86bd9eaa4f42e"}, {"url": "https://git.kernel.org/stable/c/c0224327b7cbed9d3198e8dbec847281053dcd06"}, {"url": "https://git.kernel.org/stable/c/2d19b95c9723001f214f7a47d67b09f46238f200"}], "title": "netfilter: nf_conntrack: defer invalid log until after unlock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74624", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:43.340591Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:06:02.842Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74624", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:43.340591Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:02:43.906Z"}}], "cna": {"title": "netfilter: nf_conntrack: defer invalid log until after unlock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The flaw is hit in nf_conntrack_tcp_packet()/nf_conntrack_sctp_packet() from the NF_INET_PRE_ROUTING and LOCAL_OUT netfilter hooks on received or forwarded TCP/SCTP traffic, so a remote peer can trigger invalid conntrack handling with crafted packets to internet-facing NAT gateways, routers, and servers.\nAC:L - Once nf_conntrack_log_invalid, nflog binding, and NFULNL_CFG_F_CONNTRACK are enabled (the CVE-scoped configuration on monitored firewalls), an attacker deterministically deadlocks by sending invalid-sequence TCP or invalid-state SCTP packets on tracked flows without races or special memory layout.\nPR:N - Triggering the vulnerable conntrack path requires only the ability to send TCP/SCTP packets to a host already running connection tracking with invalid logging; no local account, CAP_NET_ADMIN, or netlink configuration privileges are needed on the attacker side.\nUI:N - Exploitation is driven entirely by network packet delivery and softirq packet processing; no victim must open files, mount filesystems, or perform any interactive action beyond normal network connectivity to the target.\nS:U - The deadlock confines impact to the same kernel networking authority processing the packet; it does not cross VM, container, or IOMMU boundaries to compromise a separate security domain.\nC:N - This is a recursive spinlock deadlock in conntrack invalid logging with no memory corruption, out-of-bounds access, use-after-free, or information-disclosure primitive.\nI:N - The bug causes a lock re-entry hang during logging only; it does not modify kernel or user data, provide arbitrary write primitives, or enable code execution.\nA:H - Re-acquiring ct->lock while it is held deadlocks packet processing on the affected CPU in softirq context, can stall networking on that core, and may escalate to soft lockup or watchdog-induced kernel panic under sustained attack."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "ca97360eba4b3dc67f1804625542f4ccc774242a", "versionType": "git"}, {"status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "63853eb20bba4e00b7cd0b8cfc19337bbaaf5037", "versionType": "git"}, {"status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "9480fcf70a5aa9d320088a01c95df0e5e6391f4a", "versionType": "git"}, {"status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "0424186d570aa4d1ad17f516afb86bd9eaa4f42e", "versionType": "git"}, {"status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "c0224327b7cbed9d3198e8dbec847281053dcd06", "versionType": "git"}, {"status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "lessThan": "2d19b95c9723001f214f7a47d67b09f46238f200", "versionType": "git"}], "programFiles": ["net/netfilter/nf_conntrack_proto.c", "net/netfilter/nf_conntrack_proto_sctp.c", "net/netfilter/nf_conntrack_proto_tcp.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"status": "unaffected", "version": "0", "lessThan": "6.1", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/netfilter/nf_conntrack_proto.c", "net/netfilter/nf_conntrack_proto_sctp.c", "net/netfilter/nf_conntrack_proto_tcp.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/ca97360eba4b3dc67f1804625542f4ccc774242a"}, {"url": "https://git.kernel.org/stable/c/63853eb20bba4e00b7cd0b8cfc19337bbaaf5037"}, {"url": "https://git.kernel.org/stable/c/9480fcf70a5aa9d320088a01c95df0e5e6391f4a"}, {"url": "https://git.kernel.org/stable/c/0424186d570aa4d1ad17f516afb86bd9eaa4f42e"}, {"url": "https://git.kernel.org/stable/c/c0224327b7cbed9d3198e8dbec847281053dcd06"}, {"url": "https://git.kernel.org/stable/c/2d19b95c9723001f214f7a47d67b09f46238f200"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock\nis still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is\nenabled, the log path can re-enter conntrack netlink glue and dump the\nsame conntrack again. Protocol attribute dumping may take ct->lock, so\nlogging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while\nct->lock is held and emitting the log after unlocking. Also make the TCP\ntimeout-lowering invalid path return whether a log is needed, then emit\nthat log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached\nwhile ct->lock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers\nthat log invalid conntracks while holding ct->lock are caught outside TCP\nand SCTP as well."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.184", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "6.1"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "6.1"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:47.114Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74624", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:06:02.842Z", "dateReserved": "2026-08-15T05:44:03.921Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:07.193Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/netfilter/nf_conntrack_proto.c", "net/netfilter/nf_conntrack_proto_sctp.c", "net/netfilter/nf_conntrack_proto_tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "ca97360eba4b3dc67f1804625542f4ccc774242a", "status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "versionType": "git"}, {"lessThan": "63853eb20bba4e00b7cd0b8cfc19337bbaaf5037", "status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "versionType": "git"}, {"lessThan": "9480fcf70a5aa9d320088a01c95df0e5e6391f4a", "status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "versionType": "git"}, {"lessThan": "0424186d570aa4d1ad17f516afb86bd9eaa4f42e", "status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "versionType": "git"}, {"lessThan": "c0224327b7cbed9d3198e8dbec847281053dcd06", "status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "versionType": "git"}, {"lessThan": "2d19b95c9723001f214f7a47d67b09f46238f200", "status": "affected", "version": "d9a6f0d0df1899ff9086a57abc600e414f4b8cdd", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/netfilter/nf_conntrack_proto.c", "net/netfilter/nf_conntrack_proto_sctp.c", "net/netfilter/nf_conntrack_proto_tcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.184", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack: defer invalid log until after unlock\n\nTCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock\nis still held.\n\nWhen invalid logging is routed to nfnetlink_log and conntrack export is\nenabled, the log path can re-enter conntrack netlink glue and dump the\nsame conntrack again. Protocol attribute dumping may take ct->lock, so\nlogging while holding that lock can deadlock.\n\nDefer the TCP invalid logs by storing only the minimal log context while\nct->lock is held and emitting the log after unlocking. Also make the TCP\ntimeout-lowering invalid path return whether a log is needed, then emit\nthat log after unlocking.\n\nDo the same for the SCTP invalid state-transition log that can be reached\nwhile ct->lock is held.\n\nAdd a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers\nthat log invalid conntracks while holding ct->lock are caught outside TCP\nand SCTP as well."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nf_conntrack: aplazar el registro inv\u00e1lido hasta despu\u00e9s del desbloqueo\n\nLas rutas de conntrack de TCP y SCTP pueden emitir registros de paquetes inv\u00e1lidos mientras ct -> lock a\u00fan est\u00e1 retenido.\n\nCuando el registro inv\u00e1lido se enruta a nfnetlink_log y la exportaci\u00f3n de conntrack est\u00e1 habilitada, la ruta de registro puede volver a entrar en el pegamento netlink de conntrack y volcar el mismo conntrack de nuevo. El volcado de atributos del protocolo puede tomar ct -> lock, por lo que registrar mientras se retiene ese bloqueo puede causar un interbloqueo.\n\nAplazar los registros inv\u00e1lidos de TCP almacenando solo el contexto m\u00ednimo del registro mientras ct -> lock est\u00e1 retenido y emitiendo el registro despu\u00e9s del desbloqueo. Tambi\u00e9n hacer que la ruta inv\u00e1lida de reducci\u00f3n de tiempo de espera de TCP devuelva si se necesita un registro, luego emitir ese registro despu\u00e9s del desbloqueo.\n\nHacer lo mismo para el registro de transici\u00f3n de estado inv\u00e1lido de SCTP al que se puede llegar mientras ct -> lock est\u00e1 retenido.\n\nA\u00f1adir una aserci\u00f3n lockdep a nf_ct_l4proto_log_invalid() para que futuros llamadores que registren conntracks inv\u00e1lidos mientras retienen ct -> lock sean detectados tambi\u00e9n fuera de TCP y SCTP."}], "id": "CVE-2026-74624", "lastModified": "2026-10-16T20:17:47.480", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74624", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:02:43.340591Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:35.280", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0424186d570aa4d1ad17f516afb86bd9eaa4f42e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2d19b95c9723001f214f7a47d67b09f46238f200"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/63853eb20bba4e00b7cd0b8cfc19337bbaaf5037"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9480fcf70a5aa9d320088a01c95df0e5e6391f4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0224327b7cbed9d3198e8dbec847281053dcd06"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca97360eba4b3dc67f1804625542f4ccc774242a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfilter: nf_conntrack: defer invalid log until after unlock", "id": "2521365", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521365"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-833", "details": ["A flaw was found in the Linux kernel's netfilter component. Specifically, the TCP and SCTP connection tracking (conntrack) paths can attempt to log invalid packets while a critical lock is still held. If invalid logging is routed to nfnetlink_log and conntrack export is enabled, this can lead to a deadlock, resulting in a Denial of Service (DoS) for the system."], "name": "CVE-2026-74624", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74624\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74624\nhttps://lore.kernel.org/linux-cve-announce/2026082220-CVE-2026-74624-2bd0@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9a6f0d0df1899ff9086a57abc600e414f4b8cdd,63853eb20bba4e00b7cd0b8cfc19337bbaaf5037)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9a6f0d0df1899ff9086a57abc600e414f4b8cdd,9480fcf70a5aa9d320088a01c95df0e5e6391f4a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9a6f0d0df1899ff9086a57abc600e414f4b8cdd,0424186d570aa4d1ad17f516afb86bd9eaa4f42e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9a6f0d0df1899ff9086a57abc600e414f4b8cdd,c0224327b7cbed9d3198e8dbec847281053dcd06)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d9a6f0d0df1899ff9086a57abc600e414f4b8cdd,2d19b95c9723001f214f7a47d67b09f46238f200)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T16:45:03.758678+00:00", "updated": "2026-08-25T06:45:03.931564+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-833"]}