Executive brief
The Linux kernel's netfilter module contains a memory management flaw in custom conntrack expectation handling that can corrupt internal data structures. An attacker with network access can exploit this to cause kernel crashes, memory disclosure, or potentially execute arbitrary code, affecting systems using netfilter for firewall or network address translation.
Technical details
The vulnerability exists in the netfilter nft_ct (conntrack) module's handling of custom expectations. When expectations are inserted into the expectations list for unconfirmed conntracks, the data structures retain stale pointers to the wrong hlist_head due to extension reallocation, leading to use-after-free or memory corruption. The root cause is improper handling of expectation lifecycle relative to conntrack object memory layout changes. Exploitation requires network-level access to trigger conntrack creation and custom expectation paths. The fix moves custom expectation support into a helper-based mechanism with proper cleanup via a new nf_conntrack_helper_release() function. Patches are available in the Linux kernel mainline following commit resolution.
Affected products
- Linux Linux kernel multiple versions prior to patch resolution
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Fix available in Linux kernel mainline through netfilter module patch