{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-98442", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.349Z", "datePublished": "2026-10-18T15:14:52.614Z", "dateUpdated": "2026-10-24T14:08:50.801Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:50.801Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -> nf_ct_helper()\n -> helper->help()\n -> nf_ct_expect_related_report()\n -> nf_ct_expect_insert()\n -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The bug requires a locally supplied RTM_NEWTFILTER action containing TCA_CT_HELPER_NAME and COMMIT, parsed by tcf_ct_init(); a helper-recognized packet then reaches the patched tcf_ct_act(). The packet does not carry the extension-layout/action data, so this is local tc/netlink reachability.\nAC:L - The same actor can choose the helper, COMMIT, and extension state, send a packet such as a TFTP RRQ/WRQ to make nf_ct_expect_insert() link an expectation, groom krealloc, and trigger removal; no race or independent victim state is required.\nPR:L - rtnetlink_rcv_msg() gates a bound RTM_NEWTFILTER action with netlink_net_capable(CAP_NET_ADMIN) against the network namespace's user_ns. An unprivileged user can obtain that capability in a new user and network namespace.\nUI:N - The attacker installs the clsact/flower action and supplies the helper-recognized trigger traffic themselves; no separate victim action is required.\nS:U - The dangling nf_conn_help.expectations link corrupts memory within the same host kernel security authority; it does not cross a VM, IOMMU, or other scope boundary.\nC:H - After nf_ct_ext_add() moves the extension allocation, exp->lnode.pprev still targets freed storage; reclaiming that storage creates an exploitable kernel UAF capable of memory disclosure.\nI:H - nf_ct_unlink_expect_report() calls hlist_del_rcu(), which writes the expectation's next pointer through stale exp->lnode.pprev into reclaimed heap memory, enabling heap corruption and potential control-flow hijacking.\nA:H - nf_ct_remove_expectations() or nf_ct_expectation_gc() eventually performs the stale list write, which can corrupt kernel heap objects and cause an oops or panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/act_ct.c" ], "versions": [ { "version": "a21b06e7319129994f339ed47f512bbe57b77f5b", "lessThan": "31f5fe29a572037ee19c233dfe506849940c484b", "status": "affected", "versionType": "git" }, { "version": "a21b06e7319129994f339ed47f512bbe57b77f5b", "lessThan": "1679bbf5fbeac52a310b1a58b2b301bbf388bdbf", "status": "affected", "versionType": "git" }, { "version": "a21b06e7319129994f339ed47f512bbe57b77f5b", "lessThan": "812c16a255e7773a544e88b39ae6daed25544d30", "status": "affected", "versionType": "git" }, { "version": "a21b06e7319129994f339ed47f512bbe57b77f5b", "lessThan": "8988f4d11f3fba0ab38122178836c683ad516a05", "status": "affected", "versionType": "git" }, { "version": "a21b06e7319129994f339ed47f512bbe57b77f5b", "lessThan": "dad19b59da050cb60d3f7023dac2a042a84bf0bd", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/sched/act_ct.c" ], "versions": [ { "version": "6.2", "status": "affected" }, { "version": "0", "lessThan": "6.2", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.160", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.6.160" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.12.112" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "6.18.55" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.2.9" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.2", "versionEndExcluding": "7.3" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/31f5fe29a572037ee19c233dfe506849940c484b" }, { "url": "https://git.kernel.org/stable/c/1679bbf5fbeac52a310b1a58b2b301bbf388bdbf" }, { "url": "https://git.kernel.org/stable/c/812c16a255e7773a544e88b39ae6daed25544d30" }, { "url": "https://git.kernel.org/stable/c/8988f4d11f3fba0ab38122178836c683ad516a05" }, { "url": "https://git.kernel.org/stable/c/dad19b59da050cb60d3f7023dac2a042a84bf0bd" } ], "title": "net/sched: act_ct: fix helper UAF due to extensions realloc", "x_generator": { "engine": "bippy-1.2.0" } } } }