Linux Kernel CVE-2026-97609

Requires the optional nfnetlink_cttimeout module (CONFIG_NF_CT_NETLINK_TIMEOUT) to be present/loaded, and a local attacker holding CAP_NET_ADMIN to reach nf_ct_set_timeout() via an iptables/xtables CT target (do_ipt_set_ctl → xt_ct_tg_check). Exploitation additionally depends on winning a tight timing race against the module's per-net teardown (cttimeout_exit → unregister_pernet_subsys) or a network-namespace exit, so it also requires the ability to trigger that unload (root/CAP_SYS_MODULE) or repeated netns churn. Limiting factors: local access only, elevated privileges, an optional non-default module, and a narrow race window make reliable exploitation hard; outcome is a kernel crash rather than controlled corruption.

This is a use-after-free (CWE-416, though NVD lists CWE as N/A) triggered by a race between the nfnetlink_cttimeout module's teardown path (cttimeout_exit → unregister_pernet_subsys, which kfree's the per-net timeout storage) and a concurrent nf_ct_set_timeout() lookup that still dereferences the stale RCU hook. The NVD CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) is likely overstated: the vulnerability is a teardown/module-unload race, so it is crash-dominant (DoS) rather than a reliable read/write primitive. The full C:H/I:H/A:H triad appears to be boilerplate 'memory corruption implies everything' scoring - the described KASAN slab-use-after-free read supports availability impact (kernel oops) far more than confidentiality or integrity. My independent assessment lands near 5.0 with C:N/I:L/A:H. AV:L and AC:H are well justified: the attacker must win a narrow race window, and both the trigger (setting an iptables CT target via do_ipt_set_ctl) and the module unload require local privileges (CAP_NET_ADMIN and root/CAP_SYS_MODULE respectively). There is no EPSS score, no CISA KEV listing, and no public exploit - only a KASAN reproducer named in the report (poc/90). Signals are consistent: low prevalence of the exact code path, high complexity, local-only, and no evidence of real-world exploitation. This is a defense-in-depth kernel hardening fix, not an urgent-patch priority.

A local user with CAP_NET_ADMIN repeatedly installs an iptables/xtables CT target (invoking nf_ct_set_timeout) while, in parallel, the nfnetlink_cttimeout module is being unloaded (or its per-net operations torn down on netns exit). If the timeout-hook dereference lands after unregister_pernet_subsys has freed the per-net storage but before the hook is cleared, the kernel reads freed memory and typically oopses. No public exploit exists; only a KASAN proof-of-concept reproducer is referenced in the report.