CVE-2026-31414
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
In the Linux kernel netfilter subsystem, a fix was applied for unsafe use of nfct_help() without holding a reference to the master conntrack entry when dumping helper names in ctnetlink and /proc. The patch uses expect->helper instead to avoid potential memory safety issues.
Risk Assessment
The organization may face system crashes or potential information disclosure due to unsafe memory access when handling connection expectations in the network filter.
Recommendation
Immediately update the Linux kernel to a version containing the fix (commit 1a8a6e2c5c9b or later) and reboot the system.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use expect->helper Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfct_help() without holding a reference to the master conntrack is unsafe. Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nf_conntrack_expect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.