CVE-2026-31407

Root

Cause

The Linux kernel's netfilter connection tracking subsystem (conntrack) lacked proper netlink policy validation for certain attributes. Specifically, the nlattr_to_sctp() function directly assigned user-supplied CTA_PROTOINFO_SCTP_STATE to ct->proto.sctp.state without verifying it is within the valid range. Additionally, the exp->dir field (tuple hash direction) was not validated, allowing values such as 100 to be used as an index into ct->master->tuplehash[], leading to out-of-bounds memory access [1].

Exploitation

An attacker with access to netlink sockets can send crafted netlink messages to trigger these vulnerabilities. No special privileges beyond netlink socket access (e.g., CAP_NET_ADMIN) are required, though such access may be restricted in some environments. The attack does not require authentication if netlink is exposed [1].

Impact

Successful exploitation results in a slab-out-of-bounds read, as confirmed by the reporter Hyunwoo Kim. This can lead to information disclosure (reading beyond the intended memory) or a system crash (denial of service). The worst-case scenario may involve kernel memory leakage [1].

Mitigation

Patches have been applied to the Linux kernel stable trees, adding missing netlink policy validations. Users should update their kernels to versions containing the commits referenced in [1]. No workarounds are available; updating is the recommended course of action.