CVE-2026-31414

Vulnerability

This is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically in the nf_conntrack_expect functionality. The root cause is that the code in ctnetlink and /proc used nfct_help() to dump the helper name without holding a reference to the master conntrack. This can lead to a use-after-free scenario when the master conntrack is freed while the expectation still references it.

Exploitation

The attack surface is local, requiring the attacker to have the ability to create and manage netfilter expectations via ctnetlink or other means. The attacker does not need to hold any special authentication beyond being able to interact with the netfilter system. The vulnerability is triggered when the system dumps the helper name for an expectation after the master conntrack has been freed.

Impact

An attacker who successfully exploits this use-after-free could potentially execute arbitrary code in kernel context, leading to full system compromise. This includes the ability to install programs, view, change, or delete data, or create new accounts with full user rights.

Mitigation

The fix is included in the Linux kernel stable branches as commit [1][2][3][4]. Users should apply the latest kernel updates to remediate this vulnerability. No workaround is known.