CVE-2026-97609 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, as well as users of Linux-based systems, should be aware of this vulnerability and take steps to mitigate it. This includes reviewing and applying the provided kernel patches, ensuring that the Linux kernel is updated to a version that includes the fix, and monitoring system logs for potential exploitation attempts.

Why it matters

A use-after-free vulnerability in the Linux kernel's netfilter component could allow for potential code execution or denial of service. Linux kernel developers and users should review and apply patches, update to a fixed version, and monitor system logs.

• Potential code execution or denial of service
• Requires verification of affected versions and remediation status
• Necessary to review and apply kernel patches
• May require updating Linux kernel to a fixed version

Technical summary

The vulnerability exists in the Linux kernel's netfilter component, specifically in the cttimeout_exit() function. The function unregisters the per-net operations before clearing the hook, allowing for a potential use-after-free condition. This can be exploited by an attacker to potentially execute arbitrary code or cause a denial of service. The hook still points to ctnl_timeout_find_get() when CPU 1 looks up the already freed per-net timeout list. KASAN reported a slab-use-after-free in ctnl_timeout_find_get. The vulnerability can be addressed by clearing the hook and waiting for existing readers before unregistering the per-net operations.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided kernel patches to address the vulnerability
• Ensure that the Linux kernel is updated to a version that includes the fix
• Monitor system logs for potential exploitation attempts
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The vulnerability was reported by KASAN and involves a use-after-free condition in the cttimeout_exit() function. The hook still points to ctnl_timeout_find_get() when CPU 1 looks up the already freed per-net timeout list.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.