CVE-2026-31496

Overview

CVE-2026-31496 is a medium-severity information disclosure vulnerability in the Linux kernel's netfilter subsystem. The bug resides in the way the nf_conntrack_expect module handles expectations when accessed via the /proc filesystem. Prior to the fix, the code did not check whether a conntrack expectation belonged to the current network namespace before displaying it, potentially leaking expectations from other network namespaces [1][2].

Exploitation

An attacker with the ability to read the /proc/net/nf_conntrack_expect file in a given namespace could have observed conntrack expectations that were created in a different namespace on the same host. No special privileges beyond read access to that proc file are required, as the namespace boundary was not enforced [3]. This is similar in nature to the earlier bug CVE-2016-1574 (conntrack entries leak via proc), which was fixed by commit e77e6ff502ea [1].

Impact

By reading leaked expectations, an attacker could infer the existence of specific connections or the use of helper modules (like FTP or SIP) in other namespaces. While the information itself may be low-value in isolation, it could aid in further attacks by revealing network topology or service usage across namespaces.

Mitigation

The fix was introduced in the Linux kernel via commit 2028405ea698 (and other backport commits) [1][2][3][4]. Users are advised to update their kernels to include the patch. No workaround is known; disabling process-based access to /proc/net/nf_conntrack_expect for unprivileged users is a potential hardening measure.