Linux kernel: Use-after-free in Open vSwitch conntrack helper
Summary
The Open vSwitch (OVS) conntrack code in the Linux kernel can access a helper pointer after the connection tracking extension area has been reallocated. An attacker who can send traffic that reaches this code path may be able to crash the kernel or potentially execute code. The CNA record and OSV describe a use-after-free that is triggered when a connection is not yet confirmed and extensions are added after the helper runs. The supplied CVSS 9.8 score is not confirmed by NVD, and Positive Technologies rates it 6.2, so the severity is disputed.
Affected
- Linux kernel stable branches from the commit cae3a2627520c3795b54533c5328b77af3405dbe (introduced in 4.3) up to the fixed releases below.
- Per the CNA record, unaffected releases include 5.10.273 and later 5.10.x, 5.15.224 and later 5.15.x, 6.1.191 and later 6.1.x, 6.6.160 and later 6.6.x, 6.12.112 and later 6.12.x, 6.18.55 and later 6.18.x, and 7.2.9 and later 7.2.x.
- Only hosts with the openvswitch module loaded and conntrack in use are relevant. Exact ranges vary by distribution kernel.
Fixed in
- Upstream fix commit: afcf362625190c5260530b1d6c7daa98831f6b83, with further stable commits listed in the references.
- Fixed stable kernel releases according to OSV: 6.6.160, 6.12.112, 6.18.55 and 7.2.9.
- Ubuntu 24.04 LTS: fix in progress in 6.8.0-148.148, final fixed build unknown.
- Ubuntu 26.04 LTS: fix in progress in 7.0.0-42.42, final fixed build unknown.
- Ubuntu 26.10: not affected.
- Alpaquita Linux 6.12 branch: fixed in 6.12.112-r0. 6.18 branch: fixed in 6.18.55-r0.
- Debian: DLA 4850-1 for linux-6.12 published on 22 Oct 2026; check the Debian security tracker for the package version.
- Red Hat and SUSE status: unknown.
Workaround
- No vendor-documented workaround is known.
- If OVS with conntrack is not used on a host, the openvswitch module may be unloaded or blacklisted. Test this first, as it can disrupt existing networking.
Exploitation
- No CISA KEV listing was found.
- No public proof of concept or exploit was found.
- Absence of a KEV entry does not prove that exploitation has not happened.
Our recommendation
- Identify Linux hosts with the openvswitch module loaded (lsmod) and check whether conntrack is used.
- Apply the kernel update from your distribution as soon as it is available.
- Restart hosts after updating the kernel so the fix takes effect.
- Do not rely on the CVSS 9.8 score alone; prioritise hosts that are reachable from untrusted networks.
- Monitor kernel logs for crashes or memory errors on OVS hosts until patched.
- Do not confuse this with the separate CVE-2026-98251.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit afcf362625190c5260530b1d6c7daa98831f6b83 git.kernel.org
- Linux kernel stable commit 18866dc1f525f9ee4de7709529d1ae1af8d8e8be git.kernel.org
- Linux kernel stable commit f53d13a286fb275bda0efdf445b8a1e4dfcb717b git.kernel.org
- OSV: CVE-2026-98490 osv.dev
- Ubuntu security notice CVE-2026-98490 ubuntu.com
- OSV: BELL-CVE-2026-98490 (Alpaquita) osv.dev
- Vulners: NVD:CVE-2026-98490 vulners.com
- Vulners: RH:CVE-2026-98490 (Debian DLA 4850-1 reference) vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 17:31.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation. Make sure that helpers are called at the end after all the other extensions are already added. Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway.
NVD references (8)
- https://git.kernel.org/stable/c/18866dc1f525f9ee4de7709529d1ae1af8d8e8be
- https://git.kernel.org/stable/c/1a4151e6be57b098b7a5ebfbde58585e83200cdc
- https://git.kernel.org/stable/c/5f23080a625dd7855ab91485c8d691a54a1979f0
- https://git.kernel.org/stable/c/84d47a83b7b717576de0defab46b8823a22853b0
- https://git.kernel.org/stable/c/9f308197395c1a524b736e401cbc8a2ed7d246c9
- https://git.kernel.org/stable/c/afcf362625190c5260530b1d6c7daa98831f6b83
- https://git.kernel.org/stable/c/e02a83bb0b7a203f6a22f55ad5f426765560f811
- https://git.kernel.org/stable/c/f53d13a286fb275bda0efdf445b8a1e4dfcb717b
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.