Executive brief
A vulnerability exists in the Linux kernel's Netfilter component, which handles network traffic filtering and connection tracking. An attacker could potentially exploit this flaw to cause system instability or gain unauthorized access to network data. This affects the reliability of firewalls and network gateways built on Linux.
Technical details
A vulnerability in nf_conntrack_expect was identified where the kernel used nfct_help() to access helper information without holding a proper reference to the master conntrack. This is unsafe and can lead to use-after-free or null pointer dereference scenarios when dumping helper names via ctnetlink or the /proc filesystem. The fix involves using the expect->helper pointer directly, ensuring that the helper reference is maintained correctly during the expectation's lifecycle. The vulnerability is reachable via network-based interactions with the Netfilter framework, specifically when userspace tools or network events trigger connection tracking expectation dumps. Patching is available across multiple stable kernel branches.
Affected products
- Linux Linux kernel 2.6.30 to 6.1.168, 6.2 to 6.6.134, 6.7 to 6.12.81, 6.13 to 6.18.22, 6.19 to 6.19.12, 7.0-rc1 to 7.0-rc6
Timeline
- 2026-03-25: other: Vulnerability fixed in kernel source
- 2026-04-13: disclosed: CVE published
- 2026-04-13: advisory
References
- https://git.kernel.org/stable/c/3dfd3f7712b5a800f2ba632179e9b738076a51f0
- https://git.kernel.org/stable/c/4bd1b3d839172724b33d8d02c5a4ff6a1c775417
- https://git.kernel.org/stable/c/847cb7fe26c5ce5dce0d1a41fac1ea488b7f1781
- https://git.kernel.org/stable/c/b53294bff19e56ada2f230ceb8b1ffde61cc3817
- https://git.kernel.org/stable/c/e7ccaa0a62a8ff2be5d521299ce79390c318d306
- https://git.kernel.org/stable/c/f01794106042ee27e54af6fdf5b319a2fe3df94d