CVE-2026-98442

Received Received - Intake

Use-After-Free in Linux Kernel Netfilter

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation. Make sure that helpers are called at the end after all the other extensions are already added. Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98442

EUVD

EUVD-2026-103682

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	a21b06e7319129994f339ed47f512bbe57b77f5b
Linux	Linux	a21b06e7319129994f339ed47f512bbe57b77f5b
Linux	Linux	a21b06e7319129994f339ed47f512bbe57b77f5b
Linux	Linux	a21b06e7319129994f339ed47f512bbe57b77f5b
Linux	Linux	6.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free (UAF) vulnerability in the Linux kernel's net/sched: act_ct module. It occurs when a raw pointer to extensions area is stored in an expectations list during helper calls. If more extensions are added later, the memory is reallocated, making the pointer invalid. When the expectation is later accessed, it leads to undefined behavior or crashes.

Detection Guidance

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's net/sched act_ct module. Detection requires kernel-level inspection. Check kernel logs for traces related to connection tracking helpers or expectation handling. Use commands like dmesg | grep -i 'ct' or journalctl -k | grep -i 'expect' to look for anomalies. If you suspect exploitation, monitor for crashes in kernel modules related to netfilter or connection tracking.

Impact Analysis

This vulnerability could cause system instability, crashes, or potential privilege escalation if exploited. It affects network traffic control mechanisms in the Linux kernel, potentially disrupting network services or leading to denial-of-service conditions.

Compliance Impact

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's net/sched: act_ct module, which could lead to memory corruption or crashes. It does not directly impact data privacy or security controls required by GDPR or HIPAA, as it is a low-level kernel memory management flaw rather than a data exposure or access control issue.

Mitigation Strategies

Update the Linux kernel to the latest stable version where this vulnerability has been patched. Monitor network traffic for unexpected connection tracking behavior or helper-related anomalies.

Hi! I’m here to help you understand CVE-2026-98442. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70