Linux Kernel EUVD-2026-86739

Requires local access with the ability to drive netfilter logger (re)binding - realistically CAP_NET_ADMIN in the target network namespace to write the net.netfilter.nf_log sysctl or issue nfnetlink logging configuration. The affected code paths are the nf_log_syslog and nfnetlink_log backends, and exploitation depends on winning a timing race between unregister_pernet_subsys() per-net teardown (module unload or namespace exit) and a concurrent writer that rebinds the still-registered global logger. Limiting factors: local-only vector, no remote reach, high attack complexity (narrow race window), and dependence on the backend being torn down while a rebind is in flight - this is not exploitable against a steady-state running system without inducing the teardown/rebind race.

This is a classic 'high-CVSS-but-modest-real-risk' Linux kernel race. The NVD CVSS of 7.0 (AV:L/AC:H/PR:L/UI:N/C:H/I:H/A:H) is internally reasonable on vector but the C:H/I:H impact ratings are overstated for what the description actually describes: a use-after-free triggered by an unregister-ordering race in the netfilter nf_log backends (nf_log_syslog, nfnetlink_log). The realistic outcome is a stale per-net logger pointer dereference into freed module memory - a memory-corruption/crash (DoS) primitive, not a demonstrated confidentiality or integrity compromise. All exploitation signals point to low urgency: no EPSS score provided, not in CISA KEV, and no public exploit identified. SSVC framing would be exploitation:none, automatable:no (a narrow timing race requiring local privilege), technical impact best characterized as partial/DoS rather than total. CONFLICT TO NOTE: the 'Information Disclosure' tag contradicts both the description (a write-side rebind race causing a dangling read, i.e., UAF/DoS) and CWE=N/A; treat the info-disclosure framing as unsupported. The AC:H rating is correct - winning the race requires precise timing between per-net teardown/module exit and a concurrent sysctl/netlink writer. Overall: patch in normal maintenance cadence, not an emergency.

A local user with CAP_NET_ADMIN in a network namespace repeatedly writes to the net.netfilter.nf_log sysctl (or sends nfnetlink logging config) to rebind a logger at the exact moment nf_log_syslog/nfnetlink_log is being torn down (module unload or netns exit), re-binding the still-registered global backend after the per-net selection was cleared. Once the module frees its backend memory, a subsequent sysctl read or packet-logging path dereferences the now-stale per-net logger pointer, causing a use-after-free and kernel crash. No public exploit code is identified, and the narrow race window (AC:H) makes reliable exploitation difficult.