Executive brief
A race condition vulnerability was identified in the Linux kernel's Netfilter subsystem, which manages network connection tracking. A local attacker could exploit this flaw to cause a system crash or potentially gain unauthorized access to sensitive information by manipulating network connection 'expectations' while the system is processing them. This issue affects the reliability and security of the firewall and NAT services provided by the kernel.
Technical details
A race condition exists in the Netfilter ctnetlink subsystem (specifically within nf_conntrack_netlink.c) due to improper synchronization when accessing master conntrack objects via expectations. The root cause is that holding a reference on an expectation is insufficient to guarantee the validity of the associated master conntrack object, which can be deleted while being accessed. An attacker with local access can trigger this use-after-free or null pointer dereference by racing expectation deletion or retrieval commands with the teardown of the master conntrack. The fix involves extending the nf_conntrack_expect_lock spinlock sections to cover expectation lookups and event deliveries, ensuring serialized access.
Affected products
- Linux Linux Kernel 2.6.16 to 7.0
Timeline
- 2026-03-25: other: Patch authored by Pablo Neira Ayuso
- 2026-05-06: disclosed: CVE published
- 2026-04-22: patched: Patch committed to stable tree
References
- https://git.kernel.org/stable/c/497f99b26fffdc5635706d1b4811f1ed8ee21a5b
- https://git.kernel.org/stable/c/5e1c1d22268ae710c238342c8030c21daf298168
- https://git.kernel.org/stable/c/9e1196d27ef496f404c76f7a9d03761142d991c4
- https://git.kernel.org/stable/c/bffcaad9afdfe45d7fc777397d3b83c1e3ebffe5
- https://git.kernel.org/stable/c/d52fa1fa7440676b8c238037a050ab008c22737f
- https://git.kernel.org/stable/c/f338ced0473849c9f6ed0b77ca99f1aab5826787