CVE-2026-31407
Received Received - Intake
Out-of-Bounds Read in Linux Kernel Netfilter Conntrack Component

Publication date: 2026-04-06

Last updated on: 2026-04-27

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-06
Last Modified
2026-04-27
Generated
2026-05-07
AI Q&A
2026-04-06
EPSS Evaluated
2026-05-05
NVD
EUVD
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's netfilter conntrack component, where certain netlink attributes are used without proper validation.

Specifically, the function nlattr_to_sctp() assigns a user-supplied value (CTA_PROTOINFO_SCTP_STATE) directly to an internal state variable without checking if the value is within a valid range.

This lack of validation can lead to out-of-bounds memory access, such as reading beyond the allocated memory of a connection tracking object, which can cause a slab-out-of-bounds read error.


How can this vulnerability impact me? :

The vulnerability can lead to out-of-bounds memory reads in the kernel, which may cause system instability or crashes.

Such memory access issues could potentially be exploited by an attacker to gain unauthorized information or cause denial of service by crashing the system.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart