Linux Kernel EUVD-2026-86167

Requires local access to a host running an affected kernel with the nfnetlink_log (NFLOG) logging path in use, plus the ability to create and destroy network namespaces - typically CAP_NET_ADMIN, which unprivileged users can obtain inside a user namespace on distros permitting unprivileged user namespaces. Exploitation is limited by being a timing race: the attacker must hit the window between nf_log_unset() clearing the logger pointer and ops_free_list() freeing per-net state while packets are concurrently in nf_log_packet() under rcu_read_lock(). No remote or network-facing vector exists (AV:L), and hosts without nfnetlink_log usage or without unprivileged netns creation are not practically exposed.

This is a use-after-free (CWE-416; CWE listed as N/A in input) in the Linux netfilter nfnetlink_log subsystem, triggered on network-namespace teardown: nf_log_unset() clears the logger pointer without an RCU grace period, then ops_free_list() frees per-net state while packets may still be running nf_log_packet() under rcu_read_lock(). The NVD/Linux CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) reflects a local, low-privilege LPE-class memory-corruption bug. I dispute AC:L: this is a teardown race with a narrow timing window, which realistically warrants AC:H, lowering the practical score. EPSS is absent, there is no CISA KEV listing, and no public exploit code was identified - so this is no public exploit identified at time of analysis. This is a legitimate kernel hardening fix but not an urgent, mass-exploited priority: exploitation requires local access plus the ability to create/destroy network namespaces and an active nfnetlink_log (NFLOG) logger. Note a data conflict: the input Tags label this 'Information Disclosure', but the described defect is a use-after-free memory-corruption bug, not an information-disclosure primitive - the label understates/mischaracterizes the flaw.

A local low-privileged user with permission to create and tear down network namespaces (e.g., via an unprivileged user namespace granting CAP_NET_ADMIN) sets up nfnetlink_log-based packet logging, then races namespace exit against in-flight packets traversing nf_log_packet(). Winning the race dereferences freed per-net state, causing a kernel use-after-free that can crash the host or, with heap grooming, be leveraged toward privilege escalation. No public exploit code was identified at the time of analysis.