Linux Kernel: Use-after-free in act_ct connection tracking
Summary
A use-after-free flaw exists in the Linux kernel's traffic control connection tracking action (act_ct). Connection helpers store a raw pointer to the extension area in an expectation list, and this pointer becomes invalid when further extensions are added and the area is reallocated. Accessing it later when the expectation is removed can lead to memory corruption, crashes or code execution, but only on systems that configure act_ct rules. The CNA describes the trigger as network traffic, while the CVSS vector requires local access with low privileges, so the actual exposure depends on the local configuration.
Affected
- Upstream Linux kernel from 6.2 onward, before the fixed stable releases.
- Per CNA and OSV, the fixed stable releases are 6.6.160 (6.6 branch), 6.12.112 (6.12 branch), 6.18.55 (6.18 branch) and 7.2.9 (7.2 branch).
- Distribution kernels use their own package versions. Ubuntu 24.04 LTS and 26.04 LTS were still listed as vulnerable at the time of research.
Fixed in
- Upstream stable fixes: 6.6.160, 6.12.112, 6.18.55, 7.2.9 (or later), according to CNA and OSV.
- Fixed distribution kernels: unknown. Check your distribution's security advisory.
Workaround
- No vendor-confirmed workaround known.
- If no tc rules use the connection tracking action (ct), the vulnerable code path is not reachable. Check with the tc filter listing on each system.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found.
- EPSS score 0.00168 (NVD mirror data).
- The CVSS base score is disputed: 7.8 (CVSS 3.1 vector in CVE data) versus 10.0 (VulDB). No NVD or CNA score confirmed.
Our recommendation
- Check whether Linux systems use tc with connection tracking (act_ct), especially routers, firewalls and Open vSwitch gateways.
- Install the kernel update from your distribution as soon as it is available.
- If no fix is available yet, restrict local access and limit gateway functions on affected systems.
- Monitor the security advisories of your distribution.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Ubuntu security notice CVE-2026-98442 ubuntu.com
- Kernel stable commit 1679bbf5 git.kernel.org
- Kernel stable commit 31f5fe29 git.kernel.org
- Kernel stable commit 812c16a2 git.kernel.org
- Kernel stable commit 8988f4d1 git.kernel.org
- Kernel stable commit dad19b59 git.kernel.org
- VulDB entry 421782 vuldb.com
- OSV entry BELL-CVE-2026-98442 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:46.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation. Make sure that helpers are called at the end after all the other extensions are already added. Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway.
NVD references (5)
- https://git.kernel.org/stable/c/1679bbf5fbeac52a310b1a58b2b301bbf388bdbf
- https://git.kernel.org/stable/c/31f5fe29a572037ee19c233dfe506849940c484b
- https://git.kernel.org/stable/c/812c16a255e7773a544e88b39ae6daed25544d30
- https://git.kernel.org/stable/c/8988f4d11f3fba0ab38122178836c683ad516a05
- https://git.kernel.org/stable/c/dad19b59da050cb60d3f7023dac2a042a84bf0bd
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.