CVE-2026-97609

Executive Summary

CVE-2026-97609 is a use-after-free (UAF) vulnerability in the Linux kernel's netfilter conntrack timeout subsystem (nfnetlink_cttimeout). During module unload, cttimeout_exit() unregisters per-net operations and frees the associated per-net data before the timeout hook is cleared, allowing a concurrent nf_ct_set_timeout() call on another CPU to dereference the stale hook and access freed memory. The vulnerability requires local access and a specific race window, but successful exploitation can lead to privilege escalation or denial of service in environments where netfilter conntrack timeout is loaded and used (e.g., container hosts, NAT gateways, VPN endpoints). No public PoC or exploit code is currently available, and no patch has been published.

Technical Analysis

The vulnerability resides in the interaction between the conntrack timeout per-net operations and the global nf_ct_timeout_hook, which is dereferenced under rcu_read_lock() in nf_ct_set_timeout(). The relevant functions and flow per the NVD description are:

• nf_ct_set_timeout() acquires rcu_read_lock(), reads nf_ct_timeout_hook, and calls h->timeout_find_get(), which resolves to ctnl_timeout_find_get() (from the nfnetlink_cttimeout module). This function then calls nfct_timeout_pernet() to obtain the per-net timeout list.
• cttimeout_exit() (module unload path) calls unregister_pernet_subsys(), which frees the per-net data (kfree(pernet)) via ops_undo_list() / unregister_pernet_operations().

The race window is as follows:

• CPU 0 executes cttimeout_exit() and unregisters the per-net subsystem, causing kfree(pernet) to free the per-net data. The hook still points to ctnl_timeout_find_get() at this point.
• CPU 1 concurrently enters nf_ct_set_timeout(), takes rcu_read_lock(), reads the still-installed hook, calls ctnl_timeout_find_get(), and then accesses the already-freed per-net timeout list via nfct_timeout_pernet().

KASAN confirmed a slab-use-after-free read in ctnl_timeout_find_get with the following call trace: ctnl_timeout_find_get → nf_ct_set_timeout → xt_ct_tg_check → xt_check_target → do_ipt_set_ctl. This path is reachable when a user adds an iptables rule using the CT target with a timeout parameter (e.g., -j CT --timeout), which calls xt_ct_tg_check() and ultimately nf_ct_set_timeout().

The root cause is that cttimeout_exit() unregisters the per-net operations (freeing per-net data) before clearing the nf_ct_timeout_hook. The correct order is to first clear the hook and then wait for existing readers (e.g., via synchronize_rcu()) before unregistering per-net operations. This prevents any new reader from obtaining the stale hook pointer while the per-net data is still valid.

The attack surface is local: an attacker must be able to load/unload the nfnetlink_cttimeout module or trigger module unload (requires privileged access such as root or CAP_SYS_MODULE) and concurrently add iptables CT rules (requires CAP_NET_ADMIN). In containerized environments, module unload is typically restricted, but a privileged container with access to the host network namespace and the ability to unload modules could trigger this. The vulnerability is a classic UAF race that can lead to memory corruption; exploitation for privilege escalation is possible but nontrivial due to the race's timing constraints.

Exploitation Scenarios

No public proof-of-concept is available. The following chain is inferred from the vulnerability class (UAF) and the exact call trace provided in the NVD description. It uses only function names and mechanisms explicitly present in the advisory.

1. Reconnaissance / Target Identification: The attacker identifies a Linux system where the nfnetlink_cttimeout module is loaded and where the attacker has the ability to unload it (or trigger its unload) while simultaneously issuing iptables commands. This is typical of privileged local access scenarios: a root user, a process with CAP_SYS_MODULE and CAP_NET_ADMIN, or a privileged container with host network namespace access.

2. Triggering the Flaw Class (Race Condition): The attacker orchestrates a race between two execution paths:

   • Unload path (CPU 0): Invoke rmmod nfnetlink_cttimeout (or equivalent module unload) so that cttimeout_exit() runs. This calls unregister_pernet_subsys(), which frees the per-net data via kfree(pernet). At this point, nf_ct_timeout_hook still points to ctnl_timeout_find_get().
   • Reader path (CPU 1): Concurrently, issue an iptables command that uses the CT target with a timeout parameter (e.g., adding a rule with -j CT --timeout ...). This enters do_ipt_set_ctl → xt_check_target → xt_ct_tg_check → nf_ct_set_timeout, which takes rcu_read_lock(), reads nf_ct_timeout_hook, calls ctnl_timeout_find_get(), and then nfct_timeout_pernet() dereferences the freed per-net list.

   The race window is between the kfree(pernet) in cttimeout_exit() and the hook read in nf_ct_set_timeout(). Repeated attempts increase the probability of hitting the window.

3. Payload / Execution Method: The attacker does not need a specific payload in the traditional sense; the trigger is the timing of the module unload versus the iptables command. The UAF occurs when ctnl_timeout_find_get() reads from the freed slab object. If the freed memory is reallocated with attacker-controlled data before the read, the read can be used to leak or corrupt kernel memory. At the vulnerability-class level, a UAF of this type can potentially be leveraged for privilege escalation by shaping the heap and controlling the contents of the freed object. However, no public exploit demonstrates this, and the specific slab cache and allocation size are not disclosed in the advisory.

4. Post-Exploitation Impact: A successful UAF read/write in kernel context can lead to:

   • Denial of Service: A kernel crash (as observed by KASAN) if the UAF read hits unmapped or poisoned memory.
   • Privilege Escalation: If the attacker can control the reused slab object, they may escalate from local privileged access to full kernel code execution or bypass of security modules. In container environments, this could allow escape to the host kernel.
   • Information Disclosure: A UAF read could leak kernel heap contents, including pointers that bypass KASLR.

The attack requires precise timing and privileged access (module unload and iptables manipulation). This reduces the likelihood of mass exploitation but makes it a viable target for targeted attacks in multi-tenant or container-host environments.

Impact Assessment

The CVSS vector (CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H) indicates a local attack vector with high attack complexity, high privileges required, no user interaction, and a scope change. The scope change (S:C) reflects that a kernel UAF can impact components beyond the vulnerable module, potentially affecting the entire system's confidentiality, integrity, and availability.

• Business Impact: Systems running affected Linux kernels with the netfilter conntrack timeout module loaded are at risk. This includes NAT gateways, firewalls, VPN concentrators, container hosts, and any Linux server using iptables/nftables with connection tracking timeouts. A successful exploit could lead to full system compromise, data breach, or service disruption.
• Affected Systems: Linux kernel versions that include the nfnetlink_cttimeout module and have not received the described fix. The exact affected version range is not disclosed in the advisory, but the vulnerability exists in any kernel where cttimeout_exit() unregisters per-net operations before clearing the hook.
• Blast Radius: Because the vulnerability is in the kernel, a single exploited host can be fully compromised. In virtualized or containerized environments, a container escape could affect other tenants on the same host. However, the high privileges required for module unload limit the attack surface to insiders or attackers who have already achieved a high level of access.
• EPSS: Not yet scored by FIRST.org; no EPSS value should be assumed.
• CISA KEV: Not listed. No known active exploitation in the wild at the time of writing.

Detection Guidance

Sigma Rule

title: Linux Kernel Netfilter cttimeout UAF Race Condition Attempt
id: 8f3b2a1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects concurrent module unload of nfnetlink_cttimeout and iptables CT target operations, which may indicate exploitation of CVE-2026-97609.
author: Threat Intelligence
date: 2026-01-01
logsource:
  product: linux
  service: auditd
detection:
  selection_unload:
    type: 'SYSCALL'
    syscall: 'delete_module'
    a0|contains: 'nfnetlink_cttimeout'
  selection_iptables:
    type: 'SYSCALL'
    syscall: 'setsockopt'
    exe|endswith: '/iptables'
  condition: selection_unload and selection_iptables
falsepositives:
  - Legitimate administrative module unload and iptables rule addition happening concurrently.
level: high
tags:
  - attack.t1190
  - cve.2026.97609

YARA Rule

rule CVE_2026_97609_cttimeout_UAF
{
    meta:
        description = "Detects proof-of-concept or exploit code targeting CVE-2026-97609 in Linux kernel netfilter cttimeout"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-97609"
        severity = "high"
    strings:
        $s1 = "cttimeout_exit" ascii wide
        $s2 = "ctnl_timeout_find_get" ascii wide
        $s3 = "nf_ct_set_timeout" ascii wide
        $s4 = "nfnetlink_cttimeout" ascii wide
        $s5 = "nfct_timeout_pernet" ascii wide
        $s6 = "kfree(pernet)" ascii wide
        $s7 = "unregister_pernet_subsys" ascii wide
    condition:
        uint32(0) == 0x464c457f and 3 of ($s*)
}

Suricata IDS Rule

alert ip any any -> any any (msg:"CVE-2026-97609 Linux Kernel Netfilter cttimeout UAF Race Attempt"; flow:to_server; content:"|00 00 00 00|"; depth:4; byte_test:1,&,0x01,0,relative; classtype:attempted-admin; sid:10000001; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-97609;)

Note: The UAF trigger occurs via local syscalls (module unload and iptables setsockopt), which are not directly observable on the network. This Suricata rule is a placeholder for a network-based manifestation if the race is triggered remotely via a management interface; it may not fire for local exploitation. Detection should focus on local audit logs.

Elastic Detection

process where event.type == "start" and
  process.name == "rmmod" and
  process.args == "nfnetlink_cttimeout"

This EQL rule detects the unloading of the vulnerable module, which is a prerequisite for the race. Correlate with concurrent iptables commands for higher fidelity.

Splunk SPL Query

index=linux_auditd (type=SYSCALL syscall=delete_module a0="nfnetlink_cttimeout") OR (type=SYSCALL syscall=setsockopt exe="/sbin/iptables" OR exe="/usr/sbin/iptables")
| transaction host maxspan=5s
| where eventcount > 1
| table _time host exe syscall a0

Wazuh OSSEC Rule

<group name="linux,kernel,cve-2026-97609,">
  <rule id="100001" level="12">
    <if_sid>80700</if_sid>
    <field name="audit.key">module_unload</field>
    <match>nfnetlink_cttimeout</match>
    <description>CVE-2026-97609: Suspicious unload of nfnetlink_cttimeout module - potential UAF race trigger</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
  <rule id="100002" level="12">
    <if_sid>80700</if_sid>
    <field name="audit.key">iptables</field>
    <match>CT --timeout</match>
    <description>CVE-2026-97609: iptables CT target with timeout used concurrently with module unload - potential exploit</description>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate Mitigations:

   • Avoid unloading the nfnetlink_cttimeout module while the system is in active use. If module unloading is not required, blacklist the module or ensure it is built-in (not loadable/unloadable) if possible.
   • Restrict access to delete_module and CAP_SYS_MODULE capabilities to trusted administrators only. Use SELinux/AppArmor policies to prevent unprivileged module unload.
   • In container environments, ensure that containers cannot unload host kernel modules. Use user namespaces and drop CAP_SYS_MODULE.
   • Monitor audit logs for concurrent module unload and iptables CT target operations; this activity is highly suspicious.
   • If the module is not needed, disable it at boot via kernel command line (e.g., modprobe.blacklist=nfnetlink_cttimeout) or compile the kernel without it. Note: this may impact connection tracking timeout functionality.

2. Patch/Upgrade Steps:

   • No official patch is currently available from any tracked source. Monitor the Linux kernel stable mailing list and your distribution's security advisories for a commit that reorders cttimeout_exit() to clear the hook and wait for readers before unregistering per-net operations.
   • Once a patch is released, apply the kernel update promptly. For distribution kernels, follow the vendor's guidance (e.g., Red Hat, Ubuntu, SUSE security advisories).
   • If a patch is not yet available, consider applying the fix manually if you build your own kernel: modify cttimeout_exit() to call rcu_assign_pointer(nf_ct_timeout_hook, NULL) followed by synchronize_rcu() before unregister_pernet_subsys(). This is a general description; consult the upstream fix when available.

3. Long-Term Hardening:

   • Enforce the principle of least privilege for kernel module operations. Only allow module loading/unloading by a tightly controlled set of processes.
   • Use kernel lockdown mode to prevent unauthorized module loading and unloading.
   • Enable KASAN or similar kernel sanitizers in testing environments to catch UAFs early.
   • Regularly update the kernel and monitor CVE feeds for netfilter vulnerabilities.
   • Consider using eBPF-based security monitoring to detect anomalous kernel module activity.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-97609
• Linux Kernel Netfilter Documentation: https://www.netfilter.org/documentation/
• KASAN Use-After-Free Reporting: https://www.kernel.org/doc/html/latest/dev-tools/kasan.html
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-97609 not listed)
• Linux Kernel Mailing List (LKML) archives for netfilter patches: https://lore.kernel.org/netfilter-devel/

No known threat actor campaigns or exploit-in-the-wild evidence is associated with CVE-2026-97609 at this time. No public PoC or exploit code is available.