CVE-2026-74624: netfilter: nf_conntrack: defer invalid log until after unlock

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack: defer invalid log until after unlock

TCP and SCTP conntrack paths can emit invalid-packet logs while ct->lock
is still held.

When invalid logging is routed to nfnetlink_log and conntrack export is
enabled, the log path can re-enter conntrack netlink glue and dump the
same conntrack again. Protocol attribute dumping may take ct->lock, so
logging while holding that lock can deadlock.

Defer the TCP invalid logs by storing only the minimal log context while
ct->lock is held and emitting the log after unlocking. Also make the TCP
timeout-lowering invalid path return whether a log is needed, then emit
that log after unlocking.

Do the same for the SCTP invalid state-transition log that can be reached
while ct->lock is held.

Add a lockdep assertion to nf_ct_l4proto_log_invalid() so future callers
that log invalid conntracks while holding ct->lock are caught outside TCP
and SCTP as well.

The Linux kernel CVE team has assigned CVE-2026-74624 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.1 with commit d9a6f0d0df1899ff9086a57abc600e414f4b8cdd and fixed in 6.6.152 with commit 63853eb20bba4e00b7cd0b8cfc19337bbaaf5037
	Issue introduced in 6.1 with commit d9a6f0d0df1899ff9086a57abc600e414f4b8cdd and fixed in 6.12.104 with commit 9480fcf70a5aa9d320088a01c95df0e5e6391f4a
	Issue introduced in 6.1 with commit d9a6f0d0df1899ff9086a57abc600e414f4b8cdd and fixed in 6.18.45 with commit 0424186d570aa4d1ad17f516afb86bd9eaa4f42e
	Issue introduced in 6.1 with commit d9a6f0d0df1899ff9086a57abc600e414f4b8cdd and fixed in 7.1.9 with commit c0224327b7cbed9d3198e8dbec847281053dcd06
	Issue introduced in 6.1 with commit d9a6f0d0df1899ff9086a57abc600e414f4b8cdd and fixed in 7.2 with commit 2d19b95c9723001f214f7a47d67b09f46238f200

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74624
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_conntrack_proto.c
	net/netfilter/nf_conntrack_proto_sctp.c
	net/netfilter/nf_conntrack_proto_tcp.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/63853eb20bba4e00b7cd0b8cfc19337bbaaf5037
	https://git.kernel.org/stable/c/9480fcf70a5aa9d320088a01c95df0e5e6391f4a
	https://git.kernel.org/stable/c/0424186d570aa4d1ad17f516afb86bd9eaa4f42e
	https://git.kernel.org/stable/c/c0224327b7cbed9d3198e8dbec847281053dcd06
	https://git.kernel.org/stable/c/2d19b95c9723001f214f7a47d67b09f46238f200