Linux kernel: Use-after-free in Open vSwitch conntrack commit
Summary
A flaw in the Open vSwitch connection tracking code of the Linux kernel can lead to a use-after-free. It occurs when a cloned packet with an unconfirmed conntrack entry is committed with different extensions, so the entry is modified while shared. A local user with low privileges can trigger it, and the CVSS vector rates the impact on confidentiality, integrity and availability as high. The fix resets such shared entries during commit. The issue matters mainly for hosts running Open vSwitch with conntrack, such as hypervisors and container nodes.
Affected
- Linux kernel from commit cae3a2627520c3795b54533c5328b77af3405dbe onwards (introduced in 4.3 according to OSV)
- Exact affected range: Unknown.
- Ubuntu 26.04 LTS, 24.04 LTS, 22.04 LTS and 20.04 LTS: vulnerable according to Ubuntu. Ubuntu 26.10 is not affected.
- Debian, Red Hat, SUSE, Amazon and Oracle: Unknown.
Fixed in
- Linux stable 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9 or later (according to OSV)
- Ubuntu 22.04 LTS: fix in progress in 5.15.0-202.212
- Ubuntu 24.04 LTS: fix in progress in 6.8.0-148.148
- Ubuntu 26.04 LTS: fix in progress in 7.0.0-42.42
- Ubuntu 20.04 LTS: no fix listed
- Verify the exact fixed versions in the stable release notes before deploying.
Workaround
- No separate workaround documented.
- Hosts that do not use Open vSwitch with conntrack commit have low exposure. Verify with ovs-vsctl or the hypervisor configuration.
Exploitation
- No exploitation in the wild reported in the reviewed sources.
- Not verified against the CISA KEV catalogue; this status is provisional.
- No public proof of concept found.
- EPSS: 0.0021 (low predicted exploitation probability).
Our recommendation
- Install a vendor kernel that contains the fix, starting with Ubuntu 20.04 and 22.04 hosts.
- Prioritise hypervisors, OpenStack or Kubernetes nodes and SDN appliances that run Open vSwitch with conntrack.
- Check whether Open vSwitch with conntrack is in use on each host.
- Limit local shell access on multi-tenant hosts.
- Check NVD and CISA KEV again before final classification.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux kernel stable commit 26b2bd70d22457556e2fa01cbf1192cb1a94d619 git.kernel.org
- Linux kernel stable commit 37e3c878b183a115f9a114067f9ef3b408ad27fb git.kernel.org
- Ubuntu security notice CVE-2026-98491 ubuntu.com
- OSV Bell-SW Alpaquita advisory osv.dev
- OSV CVE-2026-98491 osv.dev
- Vulners NVD mirror CVE-2026-98491 vulners.com
- VulDB CVE-2026-98491 vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:44.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1. The first clone wants to commit and runs the helpers wiring up the extension pointer into the expectation list. 2. Then it looses the confirmation keeping the entry unconfirmed. 3. Second clone now wants to commit labels and adds the new extension for that breaking the pointer in the expectation list causing UAF on the destruction path later. While this is possible to trigger, there should be no practical network pipeline where committing both clones without modifications into the same zone is needed. So, let's just reset the entry in case for some reason we got an skb with a shared one during commit. This doesn't affect any known use cases, but avoids any potential problems with sharing and modification of the unconfirmed ct entry. The fixes tag points to the introduction of helpers, since that's the main UAF trigger for the sharing.
NVD references (8)
- https://git.kernel.org/stable/c/26b2bd70d22457556e2fa01cbf1192cb1a94d619
- https://git.kernel.org/stable/c/37e3c878b183a115f9a114067f9ef3b408ad27fb
- https://git.kernel.org/stable/c/457e0df1b5711fbeb7ba1b6bfd826f5ef30e7e55
- https://git.kernel.org/stable/c/55e5256adf3940e71802e2f749cacf81518726b0
- https://git.kernel.org/stable/c/707c2dc77891a874f4e8c52c285a511079164ec8
- https://git.kernel.org/stable/c/de41ee24f77b0fc45397db3e277cae2adbd43dfe
- https://git.kernel.org/stable/c/e0fa5ea434b7e8467ef3adc64e3858b1ca2a642d
- https://git.kernel.org/stable/c/e2829ae5459ddb5fce526b2e84697edf6c0c3cef
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.