The Linux kernel netfilter nf_conntrack subsystem had a vulnerability where invalid-packet logs for TCP and SCTP connection tracking paths were emitted while the connection tracking lock (ct->lock) was still held. This could cause a deadlock because the logging path might re-enter the connection tracking netlink code and attempt to dump the same connection, which requires acquiring the same lock. The fix defers logging by storing minimal context while holding the lock and emitting the log only after unlocking. Additionally, a lock dependency assertion was added to detect future improper logging while holding the lock.

The vulnerability could cause a deadlock in the kernel when invalid TCP or SCTP packets are logged during connection tracking, potentially leading to system hangs or degraded network functionality. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to defer invalid packet logging until after releasing the connection tracking lock, preventing deadlocks. Users should apply the official kernel updates that include this fix. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.