CVE-2026-74660

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74660", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.924Z", "datePublished": "2026-08-22T15:32:33.677Z", "dateUpdated": "2026-10-16T19:16:07.659Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:41:14.285Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebt_nflog: pin the NFLOG backend\n\nnf_log_unregister() runs after the per-net teardown so its final RCU\ngrace period also drains readers that obtained the logger from a per-net\nbinding. However, ebt_nflog passes an explicit ULOG log type to\nnf_log_packet() without holding a reference on the selected logger module,\nunlike the xt_NFLOG and nft_log frontends.\n\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log\nis unloaded. The resulting interleaving is:\n\n CPU 0 CPU 1\n nfnetlink_log_fini()\n unregister_pernet_subsys()\n kfree(nfnl_log_pernet(net))\n ebt_nflog_tg()\n nf_log_packet()\n nfulnl_log_packet()\n instance_lookup_get_rcu()\n\nThe global ULOG logger is still registered at this point, so CPU 1\ndereferences the per-net state after CPU 0 has freed it. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu\n Read of size 8 at addr ff110001052e6210 by task poc/92\n Call Trace:\n instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\n nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\n nf_log_packet+0x204/0x300\n ebt_nflog_tg+0x351/0x550\n ebt_do_table+0xedf/0x22b0\n Allocated by task 90:\n __kmalloc_noprof+0x186/0x470\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n register_pernet_subsys+0x23/0x40\n Freed by task 93:\n kfree+0x131/0x3c0\n ops_undo_list+0x3e3/0x700\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\n\nAcquire the ULOG logger module reference when an ebt_nflog rule is\nvalidated and release it when the rule is destroyed. Request the NFLOG\nbackend for legacy callers when needed, matching xt_NFLOG. This prevents\nmodule teardown until all ebt_nflog rules have stopped using the logger."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached through ebtables setsockopt rule installation and nfnetlink_log module teardown (local administrative paths); per kernel CNA guidance, netfilter/ebtables bugs are scored Local even when bridge hook evaluation can be driven by forwarded frames.\nAC:L - The KASAN reproducer uses a deterministic two-thread race between nfnetlink_log_fini() module removal and concurrent bridge traffic through an active ebt_nflog rule; the attacker controls both the unload timing and packet generation without depending on uncontrollable victim state.\nPR:L - Installing an ebt_nflog rule requires CAP_NET_ADMIN in the socket network namespace, obtainable by unprivileged users via user+network namespaces (unshare -Urn); the documented PoC races module teardown concurrently with rule-driven traffic, matching standard CNA treatment for ebtables/netfilter paths.\nUI:N - No victim interaction is required beyond the attacker's own ebtables configuration, module unload coordination, and bridge traffic generation to hit the active nflog target during the teardown window.\nS:U - The slab use-after-free corrupts host kernel memory within the same security authority; this is not a VM escape, container breakout across an IOMMU boundary, or other cross-scope privilege transition.\nC:H - KASAN confirmed a slab use-after-free read in instance_lookup_get_rcu() against freed nfnl_log_pernet state; UAF on the per-net instance hash table enables attacker-influenced heap reads and disclosure of adjacent kernel memory contents.\nI:H - Use-after-free on the nfnl_log_pernet structure and nfulnl_instance objects provides standard heap grooming primitives; freed slab reuse can redirect subsequent logging operations into attacker-controlled data for arbitrary kernel writes or control-flow hijack.\nA:H - The UAF read on freed per-net logging state can immediately trigger a kernel BUG/oops (as reported by KASAN) and reliably causes denial of service; repeated bridge traffic during module teardown can panic the affected host."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/netfilter/ebt_nflog.c"], "versions": [{"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "3bcce49d617c593c7606083bfdb464a1761fa68d", "status": "affected", "versionType": "git"}, {"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "394d7939c6b2b9e6bea0844c89efb5913168d898", "status": "affected", "versionType": "git"}, {"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "2cac4294f184c9bc19ff82552c62b80498694c39", "status": "affected", "versionType": "git"}, {"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "9d8a94b48b393885e7f876c8ef68ed4da5012078", "status": "affected", "versionType": "git"}, {"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "6809379a860b9fccbb5435bf08343f6d081ac68d", "status": "affected", "versionType": "git"}, {"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb", "status": "affected", "versionType": "git"}, {"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "e2ab7e878bdbe80104c879c31fd2d82a476703b8", "status": "affected", "versionType": "git"}, {"version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "30825970339c107bacaf7f61af90fcdb1f597ca1", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/bridge/netfilter/ebt_nflog.c"], "versions": [{"version": "4.12", "status": "affected"}, {"version": "0", "lessThan": "4.12", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.12", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3bcce49d617c593c7606083bfdb464a1761fa68d"}, {"url": "https://git.kernel.org/stable/c/394d7939c6b2b9e6bea0844c89efb5913168d898"}, {"url": "https://git.kernel.org/stable/c/2cac4294f184c9bc19ff82552c62b80498694c39"}, {"url": "https://git.kernel.org/stable/c/9d8a94b48b393885e7f876c8ef68ed4da5012078"}, {"url": "https://git.kernel.org/stable/c/6809379a860b9fccbb5435bf08343f6d081ac68d"}, {"url": "https://git.kernel.org/stable/c/47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb"}, {"url": "https://git.kernel.org/stable/c/e2ab7e878bdbe80104c879c31fd2d82a476703b8"}, {"url": "https://git.kernel.org/stable/c/30825970339c107bacaf7f61af90fcdb1f597ca1"}], "title": "netfilter: ebt_nflog: pin the NFLOG backend", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74660", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:02.258811Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:16:07.659Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74660", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:14:02.258811Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:14:03.831Z"}}], "cna": {"title": "netfilter: ebt_nflog: pin the NFLOG backend", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The UAF is reached through ebtables setsockopt rule installation and nfnetlink_log module teardown (local administrative paths); per kernel CNA guidance, netfilter/ebtables bugs are scored Local even when bridge hook evaluation can be driven by forwarded frames.\nAC:L - The KASAN reproducer uses a deterministic two-thread race between nfnetlink_log_fini() module removal and concurrent bridge traffic through an active ebt_nflog rule; the attacker controls both the unload timing and packet generation without depending on uncontrollable victim state.\nPR:L - Installing an ebt_nflog rule requires CAP_NET_ADMIN in the socket network namespace, obtainable by unprivileged users via user+network namespaces (unshare -Urn); the documented PoC races module teardown concurrently with rule-driven traffic, matching standard CNA treatment for ebtables/netfilter paths.\nUI:N - No victim interaction is required beyond the attacker's own ebtables configuration, module unload coordination, and bridge traffic generation to hit the active nflog target during the teardown window.\nS:U - The slab use-after-free corrupts host kernel memory within the same security authority; this is not a VM escape, container breakout across an IOMMU boundary, or other cross-scope privilege transition.\nC:H - KASAN confirmed a slab use-after-free read in instance_lookup_get_rcu() against freed nfnl_log_pernet state; UAF on the per-net instance hash table enables attacker-influenced heap reads and disclosure of adjacent kernel memory contents.\nI:H - Use-after-free on the nfnl_log_pernet structure and nfulnl_instance objects provides standard heap grooming primitives; freed slab reuse can redirect subsequent logging operations into attacker-controlled data for arbitrary kernel writes or control-flow hijack.\nA:H - The UAF read on freed per-net logging state can immediately trigger a kernel BUG/oops (as reported by KASAN) and reliably causes denial of service; repeated bridge traffic during module teardown can panic the affected host."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "3bcce49d617c593c7606083bfdb464a1761fa68d", "versionType": "git"}, {"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "394d7939c6b2b9e6bea0844c89efb5913168d898", "versionType": "git"}, {"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "2cac4294f184c9bc19ff82552c62b80498694c39", "versionType": "git"}, {"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "9d8a94b48b393885e7f876c8ef68ed4da5012078", "versionType": "git"}, {"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "6809379a860b9fccbb5435bf08343f6d081ac68d", "versionType": "git"}, {"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb", "versionType": "git"}, {"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "e2ab7e878bdbe80104c879c31fd2d82a476703b8", "versionType": "git"}, {"status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "lessThan": "30825970339c107bacaf7f61af90fcdb1f597ca1", "versionType": "git"}], "programFiles": ["net/bridge/netfilter/ebt_nflog.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"status": "unaffected", "version": "0", "lessThan": "4.12", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/bridge/netfilter/ebt_nflog.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/3bcce49d617c593c7606083bfdb464a1761fa68d"}, {"url": "https://git.kernel.org/stable/c/394d7939c6b2b9e6bea0844c89efb5913168d898"}, {"url": "https://git.kernel.org/stable/c/2cac4294f184c9bc19ff82552c62b80498694c39"}, {"url": "https://git.kernel.org/stable/c/9d8a94b48b393885e7f876c8ef68ed4da5012078"}, {"url": "https://git.kernel.org/stable/c/6809379a860b9fccbb5435bf08343f6d081ac68d"}, {"url": "https://git.kernel.org/stable/c/47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb"}, {"url": "https://git.kernel.org/stable/c/e2ab7e878bdbe80104c879c31fd2d82a476703b8"}, {"url": "https://git.kernel.org/stable/c/30825970339c107bacaf7f61af90fcdb1f597ca1"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebt_nflog: pin the NFLOG backend\n\nnf_log_unregister() runs after the per-net teardown so its final RCU\ngrace period also drains readers that obtained the logger from a per-net\nbinding. However, ebt_nflog passes an explicit ULOG log type to\nnf_log_packet() without holding a reference on the selected logger module,\nunlike the xt_NFLOG and nft_log frontends.\n\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log\nis unloaded. The resulting interleaving is:\n\n CPU 0 CPU 1\n nfnetlink_log_fini()\n unregister_pernet_subsys()\n kfree(nfnl_log_pernet(net))\n ebt_nflog_tg()\n nf_log_packet()\n nfulnl_log_packet()\n instance_lookup_get_rcu()\n\nThe global ULOG logger is still registered at this point, so CPU 1\ndereferences the per-net state after CPU 0 has freed it. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu\n Read of size 8 at addr ff110001052e6210 by task poc/92\n Call Trace:\n instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\n nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\n nf_log_packet+0x204/0x300\n ebt_nflog_tg+0x351/0x550\n ebt_do_table+0xedf/0x22b0\n Allocated by task 90:\n __kmalloc_noprof+0x186/0x470\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n register_pernet_subsys+0x23/0x40\n Freed by task 93:\n kfree+0x131/0x3c0\n ops_undo_list+0x3e3/0x700\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\n\nAcquire the ULOG logger module reference when an ebt_nflog rule is\nvalidated and release it when the rule is destroyed. Request the NFLOG\nbackend for legacy callers when needed, matching xt_NFLOG. This prevents\nmodule teardown until all ebt_nflog rules have stopped using the logger."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "4.12"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "4.12"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:41:14.285Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74660", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:16:07.659Z", "dateReserved": "2026-08-15T05:44:03.924Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:33.677Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/bridge/netfilter/ebt_nflog.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3bcce49d617c593c7606083bfdb464a1761fa68d", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}, {"lessThan": "394d7939c6b2b9e6bea0844c89efb5913168d898", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}, {"lessThan": "2cac4294f184c9bc19ff82552c62b80498694c39", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}, {"lessThan": "9d8a94b48b393885e7f876c8ef68ed4da5012078", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}, {"lessThan": "6809379a860b9fccbb5435bf08343f6d081ac68d", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}, {"lessThan": "47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}, {"lessThan": "e2ab7e878bdbe80104c879c31fd2d82a476703b8", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}, {"lessThan": "30825970339c107bacaf7f61af90fcdb1f597ca1", "status": "affected", "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/bridge/netfilter/ebt_nflog.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.12"}, {"lessThan": "4.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebt_nflog: pin the NFLOG backend\n\nnf_log_unregister() runs after the per-net teardown so its final RCU\ngrace period also drains readers that obtained the logger from a per-net\nbinding. However, ebt_nflog passes an explicit ULOG log type to\nnf_log_packet() without holding a reference on the selected logger module,\nunlike the xt_NFLOG and nft_log frontends.\n\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log\nis unloaded. The resulting interleaving is:\n\n CPU 0 CPU 1\n nfnetlink_log_fini()\n unregister_pernet_subsys()\n kfree(nfnl_log_pernet(net))\n ebt_nflog_tg()\n nf_log_packet()\n nfulnl_log_packet()\n instance_lookup_get_rcu()\n\nThe global ULOG logger is still registered at this point, so CPU 1\ndereferences the per-net state after CPU 0 has freed it. KASAN reported:\n\n BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu\n Read of size 8 at addr ff110001052e6210 by task poc/92\n Call Trace:\n instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\n nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\n nf_log_packet+0x204/0x300\n ebt_nflog_tg+0x351/0x550\n ebt_do_table+0xedf/0x22b0\n Allocated by task 90:\n __kmalloc_noprof+0x186/0x470\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n register_pernet_subsys+0x23/0x40\n Freed by task 93:\n kfree+0x131/0x3c0\n ops_undo_list+0x3e3/0x700\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\n\nAcquire the ULOG logger module reference when an ebt_nflog rule is\nvalidated and release it when the rule is destroyed. Request the NFLOG\nbackend for legacy callers when needed, matching xt_NFLOG. This prevents\nmodule teardown until all ebt_nflog rules have stopped using the logger."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: ebt_nflog: fijar el backend de NFLOG\n\nnf_log_unregister() se ejecuta despu\u00e9s del desmantelamiento por red, por lo que su per\u00edodo de gracia RCU final tambi\u00e9n drena a los lectores que obtuvieron el registrador de una vinculaci\u00f3n por red. Sin embargo, ebt_nflog pasa un tipo de registro ULOG expl\u00edcito a nf_log_packet() sin mantener una referencia en el m\u00f3dulo de registrador seleccionado, a diferencia de los frontends xt_NFLOG y nft_log.\n\nUna regla nflog de ebtables puede, por lo tanto, permanecer invocable mientras nfnetlink_log est\u00e1 descargado. El entrelazado resultante es:\n\n CPU 0 CPU 1\n nfnetlink_log_fini()\n unregister_pernet_subsys()\n kfree(nfnl_log_pernet(net))\n ebt_nflog_tg()\n nf_log_packet()\n nfulnl_log_packet()\n instance_lookup_get_rcu()\n\nEl registrador ULOG global todav\u00eda est\u00e1 registrado en este punto, por lo que la CPU 1 desreferencia el estado por red despu\u00e9s de que la CPU 0 lo haya liberado. KASAN inform\u00f3:\n\n ERROR: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en instance_lookup_get_rcu\n Lectura de tama\u00f1o 8 en la direcci\u00f3n ff110001052e6210 por la tarea PoC/92\n Rastro de Llamada:\n instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\n nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\n nf_log_packet+0x204/0x300\n ebt_nflog_tg+0x351/0x550\n ebt_do_table+0xedf/0x22b0\n Asignado por la tarea 90:\n __kmalloc_noprof+0x186/0x470\n ops_init+0x6d/0x420\n register_pernet_operations+0x2f6/0x670\n register_pernet_subsys+0x23/0x40\n Liberado por la tarea 93:\n kfree+0x131/0x3c0\n ops_undo_list+0x3e3/0x700\n unregister_pernet_operations+0x232/0x490\n unregister_pernet_subsys+0x1c/0x30\n nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\n\nAdquirir la referencia del m\u00f3dulo de registrador ULOG cuando una regla ebt_nflog es validada y liberarla cuando la regla es destruida. Solicitar el backend de NFLOG para llamadores heredados cuando sea necesario, coincidiendo con xt_NFLOG. Esto evita el desmantelamiento del m\u00f3dulo hasta que todas las reglas ebt_nflog hayan dejado de usar el registrador."}], "id": "CVE-2026-74660", "lastModified": "2026-10-16T20:17:50.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74660", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:14:02.258811Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:39.743", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2cac4294f184c9bc19ff82552c62b80498694c39"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/30825970339c107bacaf7f61af90fcdb1f597ca1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/394d7939c6b2b9e6bea0844c89efb5913168d898"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3bcce49d617c593c7606083bfdb464a1761fa68d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6809379a860b9fccbb5435bf08343f6d081ac68d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9d8a94b48b393885e7f876c8ef68ed4da5012078"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e2ab7e878bdbe80104c879c31fd2d82a476703b8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: netfilter: ebt_nflog: pin the NFLOG backend", "id": "2521495", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521495"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnetfilter: ebt_nflog: pin the NFLOG backend\nnf_log_unregister() runs after the per-net teardown so its final RCU\ngrace period also drains readers that obtained the logger from a per-net\nbinding. However, ebt_nflog passes an explicit ULOG log type to\nnf_log_packet() without holding a reference on the selected logger module,\nunlike the xt_NFLOG and nft_log frontends.\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log\nis unloaded. The resulting interleaving is:\nCPU 0 CPU 1\nnfnetlink_log_fini()\nunregister_pernet_subsys()\nkfree(nfnl_log_pernet(net))\nebt_nflog_tg()\nnf_log_packet()\nnfulnl_log_packet()\ninstance_lookup_get_rcu()\nThe global ULOG logger is still registered at this point, so CPU 1\ndereferences the per-net state after CPU 0 has freed it. KASAN reported:\nBUG: KASAN: slab-use-after-free in instance_lookup_get_rcu\nRead of size 8 at addr ff110001052e6210 by task poc/92\nCall Trace:\ninstance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\nnfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\nnf_log_packet+0x204/0x300\nebt_nflog_tg+0x351/0x550\nebt_do_table+0xedf/0x22b0\nAllocated by task 90:\n__kmalloc_noprof+0x186/0x470\nops_init+0x6d/0x420\nregister_pernet_operations+0x2f6/0x670\nregister_pernet_subsys+0x23/0x40\nFreed by task 93:\nkfree+0x131/0x3c0\nops_undo_list+0x3e3/0x700\nunregister_pernet_operations+0x232/0x490\nunregister_pernet_subsys+0x1c/0x30\nnfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\nAcquire the ULOG logger module reference when an ebt_nflog rule is\nvalidated and release it when the rule is destroyed. Request the NFLOG\nbackend for legacy callers when needed, matching xt_NFLOG. This prevents\nmodule teardown until all ebt_nflog rules have stopped using the logger.", "A flaw was found in the Linux kernel's `netfilter: ebt_nflog` component. This vulnerability occurs because the `ebt_nflog` module does not properly manage references to the `nfnetlink_log` module. An attacker with the ability to configure `ebtables` rules could exploit this by causing an `ebtables nflog` rule to remain active while the `nfnetlink_log` module is unloaded. This improper handling leads to a use-after-free error, which can result in a system crash, causing a Denial of Service (DoS)."], "name": "CVE-2026-74660", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74660\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74660\nhttps://lore.kernel.org/linux-cve-announce/2026082227-CVE-2026-74660-15ff@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,3bcce49d617c593c7606083bfdb464a1761fa68d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,394d7939c6b2b9e6bea0844c89efb5913168d898)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,2cac4294f184c9bc19ff82552c62b80498694c39)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,9d8a94b48b393885e7f876c8ef68ed4da5012078)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,6809379a860b9fccbb5435bf08343f6d081ac68d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,e2ab7e878bdbe80104c879c31fd2d82a476703b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c83fa19603bdaeef17b815713dbbe3230c8a34ee,30825970339c107bacaf7f61af90fcdb1f597ca1)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.12"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.12)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.265,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,6.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:00:04.733309+00:00", "updated": "2026-08-25T14:00:17.977646+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}