Executive brief
A synchronization issue was identified in the Linux kernel's Netfilter component, which handles network traffic filtering and firewalling. In specific error scenarios, the system could incorrectly manage internal locks, potentially leading to system instability or unpredictable behavior. This issue has been resolved in recent kernel updates.
Technical details
A locking order vulnerability was discovered in the Netfilter nft_inner component of the Linux kernel. Specifically, in the nft_inner_restore_tun_ctx function's error path, local_bh_enable() was being called before local_unlock_nested_bh(). This incorrect sequence violates the expected nesting of bottom-half (BH) locking and softirq enablement, which can lead to deadlocks or kernel panics under specific race conditions. The fix reorders these calls to ensure the local lock is released before softirqs are re-enabled. The vulnerability affects kernels starting from version 6.16 and has been patched in stable branches 6.18.34, 7.0.11, and 7.1.
Affected products
- Linux Linux Kernel 6.16 to 6.18.34, 7.0.11
Timeline
- 2026-07-19: disclosed
- 2026-07-19: advisory