< Back

CVE-2026-74624

Updated on 22 Aug 2026

Severity

7.5 High severity

Details

CVSS score
7.5
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: defer invalid log until after unlock

TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock is still held.

When invalid logging is routed to nfnetlink_log and conntrack export is enabled, the log path can re-enter conntrack netlink glue and dump the same conntrack again. Protocol attribute dumping may take ct->lock, so logging while holding that lock can deadlock.

Defer the TCP invalid logs by storing only the minimal log context while ct->lock is held and emitting the log after unlocking. Also make the TCP timeout-lowering invalid path return whether a log is needed, then emit that log after unlocking.

Do the same for the SCTP invalid state-transition log that can be reached while ct->lock is held.

Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers that log invalid conntracks while holding ct->lock are caught outside TCP and SCTP as well.

Details

Affected product:
AlmaLinux 9.2 ESU , CentOS 7 ELS , CloudLinux 7 ELS , Debian 10 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU
Affected packages:
linux @ 4.19.0 (+7 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
CentOS 7 ELS Released
36 kernels
  • 3.10.0-1160.119.1.el7.tuxcare.els10
  • 3.10.0-1160.119.1.el7.tuxcare.els4
  • 3.10.0-1160.119.1.el7.tuxcare.els6
  • 3.10.0-1160.119.1.el7.tuxcare.els15
  • 3.10.0-1160.119.1.el7.tuxcare.els5
  • 3.10.0-1160.119.1.el7.tuxcare.els3
  • 3.10.0-1160.119.1.el7.tuxcare.els14
  • 3.10.0-1160.119.1.el7.tuxcare.els16
  • 3.10.0-1160.119.1.el7.tuxcare.els13
  • 3.10.0-1160.119.1.el7.tuxcare.els7
  • 3.10.0-1160.119.1.el7.tuxcare.els12
  • 3.10.0-1160.119.1.el7.tuxcare.els9
  • 3.10.0-1160.119.1.el7.tuxcare.els8
  • 3.10.0-1160.119.1.el7.tuxcare.els17
  • 3.10.0-1160.119.1.el7.tuxcare.els18
  • 3.10.0-1160.119.1.el7.tuxcare.els19
  • 3.10.0-1160.119.1.el7.tuxcare.els20
  • 3.10.0-1160.119.1.el7.tuxcare.els21
  • 3.10.0-1160.119.1.el7.tuxcare.els24
  • 3.10.0-1160.119.1.el7.tuxcare.els22
  • 3.10.0-1160.119.1.el7.tuxcare.els25
  • 3.10.0-1160.139.1.el7.tuxcare.els2
  • 3.10.0-1160.139.1.el7.tuxcare.els3
  • 3.10.0-1160.139.1.el7.tuxcare.els4
  • 3.10.0-1160.142.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els1
  • 3.10.0-1160.144.1.el7.tuxcare.els2
  • 3.10.0-1160.144.1.el7.tuxcare.els3
  • 3.10.0-1160.144.1.el7.tuxcare.els4
  • 3.10.0-1160.144.1.el7.tuxcare.els5
  • 3.10.0-1160.144.1.el7.tuxcare.els6
  • 3.10.0-1160.144.1.el7.tuxcare.els8
  • 3.10.0-1160.144.1.el7.tuxcare.els7
  • 3.10.0-1160.144.1.el7.tuxcare.els9
  • 3.10.0-1160.156.1.el7.tuxcare.els1
  • 3.10.0-1160.156.1.el7.tuxcare.els2
Debian 12 Released
43 kernels
  • 6.1.38-1
  • 6.1.38-2
  • 6.1.38-4
  • 6.1.52-1
  • 6.1.55-1
  • 6.1.64-1
  • 6.1.66-1
  • 6.1.69-1
  • 6.1.76-1
  • 6.1.27-1
  • 6.1.67-1
  • 6.1.85-1
  • 6.1.90-1
  • 6.1.94-1
  • 6.1.99-1
  • 6.1.106-3
  • 6.1.112-1
  • 6.1.115-1
  • 6.1.119-1
  • 6.1.123-1
  • 6.1.128-1
  • 6.1.124-1
  • 6.1.129-1
  • 6.1.133-1
  • 6.1.135-1
  • 6.1.137-1
  • 6.1.140-1
  • 6.1.139-1
  • 6.1.147-1
  • 6.1.148-1
  • 6.1.153-1
  • 6.1.158-1
  • 6.1.159-1
  • 6.1.162-1
  • 6.1.164-1
  • 6.1.170-1
  • 6.1.170-3
  • 6.1.172-1
  • 6.1.174-1
  • 6.1.170-2
  • 6.1.176-1
  • 6.1.177-1
  • 6.1.180-1
Debian 13 Released
15 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1
  • 6.12.100-1
  • 6.12.101-1