Linux Kernel CVE-2026-52970

The vulnerability resides in net/netfilter/nft_ct.c within the Linux kernel's nftables connection tracking (nft_ct) module, specifically in the nft_ct_expect_obj_eval() function. This function is responsible for evaluating nftables rules that manipulate connection tracking expectations - kernel objects used by the netfilter framework to anticipate related connections (e.g., for protocols like FTP or SIP that negotiate secondary flows). When the function allocates a new expectation object and calls nf_ct_expect_related(), it holds a local reference to the allocated object. The defect is that nf_ct_expect_put() is never called on this local reference prior to returning, leaving the reference count permanently elevated. Across repeated rule evaluations, unfreed references accumulate in the kernel, progressively exhausting kernel memory. The root cause class is a missing release of a kernel object after its effective lifetime (analogous to CWE-772/CWE-401), though NVD has not assigned a CWE for this entry. CPE data confirms the affected software is cpe:2.3:a:linux:linux across multiple stable branches.