Junglewise Threat Intelligence

CVE-2026-31496: Linux Kernel information leak in netfilter nf_conntrack_expect

CVE-2026-31496 · Severity: medium · CVSS 5.5 · Published 2026-04-22

Technologies: Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP, Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP, Linux Kernel, Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP. Vendors: Siemens, Linux.

Executive brief

A vulnerability in the Linux kernel's networking subsystem could allow a local user to view connection tracking information belonging to other isolated network environments (namespaces). This component is responsible for managing how the system tracks active network connections. While primarily a privacy and isolation issue, it could be used by an attacker to gain insights into the network activity of other users or containers on the same physical host.

Technical details

A vulnerability in nf_conntrack_expect.c within the Linux kernel's netfilter subsystem allowed the dumping of connection tracking expectations from other network namespaces via the /proc interface. The root cause was a missing namespace check in the exp_seq_show function, which failed to verify if the expectation entry belonged to the current sequence file's namespace. A local attacker with low privileges could exploit this to leak network state information across namespace boundaries. The issue has been resolved by adding a net_eq check to skip expectations that do not reside in the caller's namespace. Patches are available in various stable kernel branches.

Affected products

  • Linux Linux Kernel 9b03f38d0487 to 3db5647984de
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5, V3.1.6
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6

Timeline

  • 2026-03-25: other: Patch authored
  • 2026-04-22: disclosed: CVE published

References

Related threats