CVE-2026-97609

A moderate severity use-after-free flaw was found in the Linux kernel's netfilter connection tracking timeout (nfnetlink_cttimeout) subsystem. During module unload, cttimeout_exit() unregisters the per-net operations and frees the per-net timeout storage before the nf_ct_timeout hook is cleared, so a concurrent nf_ct_set_timeout() call can dereference the stale hook and read the already-freed per-net timeout list, as reported by KASAN in ctnl_timeout_find_get(). A local attacker with the ability to unload kernel modules (CAP_SYS_MODULE) and to manage netfilter rules (CAP_NET_ADMIN) could win this race window and cause a kernel crash, resulting in a denial of service; the CVE description notes potential privilege escalation, but the impact confirmed by the available evidence is denial of service.

Red Hat Enterprise Linux 9 and 10 (including kernel-rt), Red Hat In-Vehicle OS 2, and OpenShift Container Platform releases shipping RHEL CoreOS 9 are affected. The fix for these products is currently deferred because the flaw is rated Moderate and successful exploitation requires privileged local access and winning a narrow race window, so the residual risk is limited to local denial of service on systems where unprivileged users cannot unload kernel modules or reconfigure netfilter rules. Red Hat Enterprise Linux 6, 7, and 8 (including ELS streams and kernel-rt) and OpenShift Container Platform releases shipping RHEL CoreOS 8 are not affected because the vulnerable code is not present in those kernels.

Red Hat rates this flaw Moderate with a CVSS 3.1 score of 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), lower than the upstream CVEORG rating of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), because the assessed confirmed impact is to availability only; the confidentiality and integrity impacts assumed in the upstream scoring are not established by the available evidence.