CVE-2026-74660

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ebt_nflog: pin the NFLOG backend

nflogunregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebtnflog passes an explicit ULOG log type to nflogpacket() without holding a reference on the selected logger module, unlike the xtNFLOG and nft_log frontends.

An ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving is:

CPU 0 CPU 1 nfnetlinklogfini() unregisterpernetsubsys() kfree(nfnllogpernet(net)) ebtnflogtg() nflogpacket() nfulnllogpacket() instancelookupget_rcu()

The global ULOG logger is still registered at this point, so CPU 1 dereferences the per-net state after CPU 0 has freed it. KASAN reported:

BUG: KASAN: slab-use-after-free in instancelookupgetrcu Read of size 8 at addr ff110001052e6210 by task poc/92 Call Trace: instancelookupgetrcu+0x1ce/0x1f0 [nfnetlinklog] nfulnllogpacket+0x248/0x2fb0 [nfnetlinklog] nflogpacket+0x204/0x300 ebtnflogtg+0x351/0x550 ebtdotable+0xedf/0x22b0 Allocated by task 90: _kmallocnoprof+0x186/0x470 opsinit+0x6d/0x420 registerpernetoperations+0x2f6/0x670 registerpernetsubsys+0x23/0x40 Freed by task 93: kfree+0x131/0x3c0 opsundolist+0x3e3/0x700 unregisterpernetoperations+0x232/0x490 unregisterpernetsubsys+0x1c/0x30 nfnetlinklogfini+0x34/0x450 [nfnetlinklog]

Acquire the ULOG logger module reference when an ebtnflog rule is validated and release it when the rule is destroyed. Request the NFLOG backend for legacy callers when needed, matching xtNFLOG. This prevents module teardown until all ebt_nflog rules have stopped using the logger.