{"id":"AZL-104738","summary":"CVE-2026-97608 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_log: unregister loggers before per-net teardown\n\nnf_log_syslog and nfnetlink_log unregister their per-network namespace\noperations before unregistering their global logger backends. This\nleaves a window where a sysctl or netlink writer can rebind the still-\nregistered logger after the per-net pre-exit callback cleared the old\nselection.\n\nThe race looks like this:\n\n  CPU 0                                 CPU 1\n  ----                                  ----\n  unregister_pernet_subsys()\n    nf_log_unset(net, logger)\n      net-\u003enf.nf_loggers[pf] = NULL\n\n                                        lock nf_log_mutex\n                                        find logger in loggers[][]\n                                        net-\u003enf.nf_loggers[pf] = logger\n                                        unlock nf_log_mutex\n\n  nf_log_unregister(logger)\n    lock nf_log_mutex\n    loggers[pf][type] = NULL\n    unlock nf_log_mutex\n    synchronize_rcu()\n  module exit returns\n  module core frees backend memory\n\nLater, a sysctl read or packet logging operation can dereference the\nstale per-net logger pointer.\n\nFix this by unregistering the global logger backends before tearing down\nper-net state. Once the global registrations are gone, later writers can\nno longer rebind the logger. unregister_pernet_subsys() already waits\nfor an RCU grace period after the pre-exit callback clears the per-net\nselection, while nf_log_unregister() continues to cover readers of the\nglobal logger table.\n\nApply this ordering fix to both nf_log backends that combine per-net\nteardown with global logger registration.","modified":"2026-09-26T14:15:59.652796987Z","published":"2026-09-25T11:17:14Z","upstream":["CVE-2026-97608"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-97608"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-104738.json"}}],"schema_version":"1.9.0"}