Executive brief
The Linux kernel's netfilter connection tracking module has a reference counting flaw in connection timeout policy management. An attacker with network access could trigger a use-after-free condition when timeout policies are removed from the system while connections are still active, potentially allowing code execution or denial of service on affected systems.
Technical details
The vulnerability exists in the netfilter cttimeout subsystem's handling of reference counts for struct nf_ct_timeout. The root cause is improper separation between control plane (ruleset) and data plane (active connections) refcount tracking. When a timeout policy was removed via nfnetlink while existing connection entries still referenced it, a use-after-free condition could occur. The fix adds a dedicated refcount for data plane usage (active connections) and removes the control plane refcount, ensuring timeouts are only freed when all active conntrack entries have released their references. This is a network-reachable vulnerability affecting the packet filtering and connection tracking functionality in the kernel, with low preconditions required. Patches are available and the issue was fixed upstream in commit 7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549.
Affected products
- Linux Linux Kernel Multiple versions affected; patched in upstream and backported to stable branches
Timeline
- 2026-08-15: disclosed
- 2026-06-05: patched: Upstream fix committed