CVE-2026-31496
Received Received - Intake

Netfilter nf_conntrack_expect NetNS Bypass Vulnerability in Linux Kernel

Publication date: 2026-04-22

Last updated on: 2026-04-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: skip expectations in other netns via proc Skip expectations that do not reside in this netns. Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's conntrack entries via proc").

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-04-22
Last Modified
2026-04-28
Generated
2026-07-06
AI Q&A
2026-04-22
EPSS Evaluated
2026-07-05
NVD
CVE-2026-31496
EUVD
EUVD-2026-24868

Affected Vendors & Products

Showing 13 associated CPEs
Vendor Product Version / Range
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 6.13 (inc) to 6.18.21 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.11 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.131 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.80 (exc)
linux linux_kernel From 2.6.28.1 (inc) to 6.1.168 (exc)
linux linux_kernel 2.6.28

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel's netfilter component involves the nf_conntrack_expect feature. It allows skipping of connection tracking expectations that do not belong to the current network namespace (netns) when accessed via the proc filesystem.

Essentially, the vulnerability relates to improper handling of connection tracking expectations across different network namespaces, which could lead to exposure or interference between namespaces.

Impact Analysis

If exploited, this vulnerability could allow processes or users to access or interfere with connection tracking expectations that belong to other network namespaces. This could lead to potential information leakage or unintended network behavior across isolated network environments.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31496. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart