CVE-2026-98491

Received Received - Intake

Use-After-Free in Linux Kernel Open vSwitch Conntrack

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1. The first clone wants to commit and runs the helpers wiring up the extension pointer into the expectation list. 2. Then it looses the confirmation keeping the entry unconfirmed. 3. Second clone now wants to commit labels and adds the new extension for that breaking the pointer in the expectation list causing UAF on the destruction path later. While this is possible to trigger, there should be no practical network pipeline where committing both clones without modifications into the same zone is needed. So, let's just reset the entry in case for some reason we got an skb with a shared one during commit. This doesn't affect any known use cases, but avoids any potential problems with sharing and modification of the unconfirmed ct entry. The fixes tag points to the introduction of helpers, since that's the main UAF trigger for the sharing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98491

EUVD

EUVD-2026-103731

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	cae3a2627520c3795b54533c5328b77af3405dbe
Linux	Linux	4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a use-after-free (UAF) issue in the Open vSwitch connection tracking module. When an skb (socket buffer) with an unconfirmed connection tracking entry is cloned, both clones may attempt to commit changes, leading to modifications of a shared unconfirmed entry. This can corrupt the expectation list and cause a UAF during destruction.

Detection Guidance

This vulnerability is specific to the Linux kernel's Open vSwitch connection tracking module. Detection requires checking if your system is running a vulnerable kernel version and inspecting Open vSwitch configurations for potential unconfirmed connection tracking entries.

Impact Analysis

Exploitation could lead to system crashes, denial-of-service, or potential arbitrary code execution. However, the likelihood is low as it requires a specific network pipeline scenario that is not commonly used.

Compliance Impact

This vulnerability affects network packet handling in the Linux kernel's Open vSwitch conntrack module. It could potentially lead to use-after-free (UAF) issues during network packet processing, which may impact data integrity and security in systems handling sensitive data. However, the specific impact on compliance with GDPR or HIPAA depends on the system's configuration and use case, as the vulnerability is unlikely to occur in typical network pipelines.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-98491. This vulnerability affects the Open vSwitch connection tracking module and is resolved by preventing modification of shared unconfirmed connection tracking entries.

Hi! I’m here to help you understand CVE-2026-98491. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70