Skip to main content

Linux Kernel CVE-2026-90237

| EUVDEUVD-2026-81830 HIGH
2026-09-17 Linux GHSA-9xwh-87xc-mh2g
Information Disclosure Linux Red Hat Netfilter
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Obtain CAP_NET_ADMIN via user namespace
  2. Delivery
    Install nft_ct custom expectation rule
  3. Exploit
    Send matching traffic to create expectation on unconfirmed conntrack
  4. Execution
    Trigger ct-extension reallocation
  5. Persist
    Stale .pprev corrupts expectation hlist
  6. Impact
    Kernel oops / denial of service

Vulnerability Assessment

Exploitation Conditions

Requires the netfilter conntrack (nf_conntrack) and nftables ct subsystem, plus the ability to install an nft_ct rule that creates a custom conntrack expectation - which needs CAP_NET_ADMIN in the relevant network namespace (attainable by an unprivileged user through a user namespace on container/multi-tenant hosts). The attacker must then drive matching network flow so an expectation is inserted while the conntrack is unconfirmed and force a ct-extension reallocation to leave the .pprev pointer stale. Limiting factors: local access only (AV:L), privilege/config control required (not remote-unauthenticated), the specific nft_ct expectation feature must be in use, and the affected kernel must be 5.3 through the versions fixed by 7.2.6 / 7.3-rc1.
Impact

The vendor CVSS of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) overstates real-world risk. This is a memory-corruption bug in netfilter's nft_ct custom conntrack-expectation support: early insertion of expectations while the conntrack is unconfirmed leaves stale expectation-list entries whose .pprev pointer references the wrong hlist_head after the ct-extension area is reallocated (a dangling/stale-pointer condition, effectively CWE-416/824). The realistic outcome of a corrupted hlist is a kernel oops/list-poison crash - a denial of service - not the reliable confidentiality/integrity compromise the C:H/I:H metrics imply, so those are optimistic. No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so exploitation status is 'no public exploit identified at time of analysis.' The vector is local (AV:L) and requires privileges (PR:L in the vendor vector): configuring nftables ct-expectation rules needs CAP_NET_ADMIN, which an unprivileged user can obtain inside a user namespace, so PR:L is defensible rather than PR:N. Overall this is a niche, config-plus-packet-triggered local DoS worth patching on multi-tenant/container hosts but not an urgent widespread-exploitation priority. Data conflict to note: the input Tag 'Information Disclosure' contradicts the crash-primary memory-corruption nature described (C:N would be more accurate), and CWE is 'N/A' despite a clear dangling-pointer/UAF pattern.
Exploit ScenarioDerived

A local user with CAP_NET_ADMIN (obtainable via an unprivileged user namespace on a container/multi-tenant host) installs an nftables rule that creates a custom conntrack expectation, then drives matching traffic so the expectation is inserted while the conntrack is still unconfirmed. When the ct-extension area is reallocated, the stale .pprev pointer corrupts the expectation hlist and a subsequent list operation dereferences/writes through the dangling pointer, crashing the kernel. No public exploit code is identified at time of analysis.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Memory-safety corruption in the Linux kernel's netfilter nft_ct conntrack expectation code lets a local user with CAP_NET_ADMIN in a network namespace leave a stale hlist pointer (.pprev) behind after the conntrack extension area is reallocated, enabling use-after-free style reads and writes against freed memory. Affected systems run kernels from 5.3 up to the versions fixed by 7.2.6 and 7.3-rc1, and exploitation requires the nf_conntrack/nft_ct subsystem to be in use plus the ability to install an nft_ct rule that creates custom expectations and then drive matching traffic; the assessed CVSS is 5.9 (AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H), meaning denial of service and limited disclosure/modification rather than the C:H/I:H/A:H impact suggested by the vendor's 7.8 score. No public exploit code and no confirmed active exploitation were identified at time of analysis, but the affected code path is reachable by unprivileged users on multi-tenant or container hosts where unprivileged user namespaces are enabled.

RemediationAI

Patch status: patch available from vendor. Upgrade to Linux 7.2.6 or 7.3-rc1 (or a later release containing them), or backport the upstream stable fixes at https://git.kernel.org/stable/c/af3fe52fd108fd38235e4813df62442ed0f1d8ff and https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff. If an immediate kernel upgrade is not feasible, the practical compensating controls target the prerequisite rather than the bug: (1) remove CAP_NET_ADMIN from untrusted workloads and disable unprivileged user namespaces (e.g. sysctl kernel.unprivileged_userns_clone=0 on Debian-derived systems or the equivalent sysctl/user.max_user_namespaces=0), which closes the container escape route to the nft_ct ruleset path but breaks rootless containers, Podman/buildah, and some CI sandboxes; (2) restrict ruleset manipulation so only privileged admin namespaces may load nftables rules containing ct expectation expressions, accepting reduced tenant flexibility; (3) where the nft_ct custom expectation feature is unused, prevent the module from being loaded (modprobe.d blacklist of nft_ct), noting this disables all ct-based nftables matching such as 'ct state established', which many firewall rulesets rely on. These are containment measures only - they do not fix the stale .pprev pointer - so kernel patching remains the definitive remediation. Assessed risk note: the vendor score of 7.8 (C:H/I:H/A:H) overstates real-world impact; the independent assessment is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H (5.9), reflecting local access, configuration/privilege prerequisites, and primarily availability impact.

Affected VersionsENISA

Linux patch: 7.3-rc1
Linux patch: 0
Linux 857b46027d6f91150797295752581b7155b9d0e1 <af3fe52fd108fd38235e4813df62442ed0f1d8ff
Linux 5.3
Linux patch: 7.2.6
Linux 857b46027d6f91150797295752581b7155b9d0e1 <3679da4ad8be84cddaf40bc307fef1fe13e051ff

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The flaw lives in the netfilter conntrack subsystem, specifically nft_ct's custom expectation support. nf_conntrack stores per-connection metadata in an extension area that can be reallocated when additional extensions (such as a ct helper or expectation) are attached; hash lists - including the expectation list - are linked through hlist_node.pprev pointers that are baked in at insertion time. CVE-2026-90237 arises because expectations were inserted into the expectations list while the conntrack was still unconfirmed; when a later reallocation moved the extension area, the previously stored .pprev continued to point at the old hlist_head, producing a dangling pointer (stale-pointer/use-after-free class; the feed leaves CWE unassigned, but the semantics map to CWE-416/CWE-825). Earlier fixes (commit 1710eb913bdc restricting expectations to unconfirmed conntracks, and commit 7c9664351980 which moved the NAT hlist_head into struct nf_conn to allow hlist_replace_rcu fixups) only narrowed the window rather than eliminating it. The upstream resolution avoids enlarging struct nf_conn for a feature of very limited scope - expect_clash() already makes nf_ct_expect_related() return EBUSY for a second concurrent expectation - by making expectation creation best-effort (no packet drops on failure), introducing an internal ct helper attached to the conntrack to drive custom expectations, exposing nf_conntrack_helper_release() to free that helper, and restricting expectation creation to that dedicated helper. The nft_ct module's RCU grace-period wait on removal guarantees the NULL helper callback is observed before the module is unloaded. The supplied CPE strings (cpe:2.3:a:linux:linux:*:*) confirm the affected component is the kernel package itself rather than a user-space netfilter utility.

Know when Netfilter gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 6.6 MEDIUM

Local nftables config (CAP_NET_ADMIN via userns → PR:L); deterministic realloc path → AC:L; crash-primary hlist corruption gives A:H with only marginal C/I potential from the dangling pointer.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE 6.1 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 18, 2026 - 18:22 NVD
7.8 (HIGH)
Patch available
Sep 17, 2026 - 17:19 EUVD
CVE Published
Sep 17, 2026 - 16:07 cve.org
HIGH 7.8
CVE Published
Sep 17, 2026 - 16:07 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: move custom expectation support to helper

Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc ("netfilter: nft_ct: skip expectations for confirmed conntrack") which restricted it to unconfirmed conntracks.

However, early insertion of expectations into the expectations list when the conntrack is unconfirmed leads to stale entries pointing to the wrong hlist_head through .pprev due to ct extension reallocation.

Commit 7c9664351980 ("netfilter: move nat hlist_head to nf_conn") moved the nat hlist_head to nf_conn for this reason:

  1. ...
  2. When reallocation of extension area occurs we need to fixup the

bysource hash head via hlist_replace_rcu.

I'd rather not increase the size of the struct nf_conn for this feature has very limited scope: only one expectation can be created at a time given expect_clash() will make nf_ct_expect_related() reports EBUSY. For this reason, relax nf_ct_expect_related() not to drop packets in case expectation creation fails, therefore, expectation creation becomes best effort.

To address this issue, add an internal ct helper and attach it to the conntrack entry to streamline the custom ct expectation support with existing ct helpers.

Expose a new nf_conntrack_helper_release() function to release the internal helper that is allocated and attached to the conntrack entry to create the custom expectations. The nft_ct module removal always waits for rcu grace period, then the NULL helper callback is observed after this.

This patch also restricts the creation of expectations to different helpers other than this custom helper that is created for this type of expectations.

Executive ViewAI

Why It Matters

A memory-safety flaw in the Linux kernel's netfilter nft_ct conntrack expectation code affects kernels 5.3 through versions prior to 7.2.6/7.3-rc1, allowing a local low-privileged user with CAP_NET_ADMIN in a network namespace to trigger use-after-free reads and writes. This can cause denial of service and limited data disclosure or modification on multi-tenant or container hosts, making platform availability and tenant isolation the primary business concerns. No public exploit identified at time of analysis.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 91% exploitable
Prevalence
Low
Linux ubiquitous but nft_ct custom conntrack-expectation feature is a niche code path
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

More in Netfilter

View all
CVE-2015-6496 MEDIUM POC
5.0 Aug 24

conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using
CVE-2019-11360 MEDIUM POC
4.2 Jul 12

A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or

CVE-2012-2663 HIGH
7.5 Feb 15

extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow r
CVE-2026-90062 HIGH
7.1 Sep 17

Netfilter nf_tables in the Linux kernel performed the hardware-offload step before allocating the chain blob during rule
CVE-2026-97608 HIGH
7.0 Sep 25

Linux kernel netfilter logging (the nf_log_syslog and nfnetlink_log backends) contains a teardown-ordering race that lea
CVE-2026-97609 HIGH
7.0 Sep 25

A use-after-free race in the Linux kernel's nfnetlink_cttimeout netfilter module lets a local attacker who holds CAP_NET

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-90237 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 REF https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff REF https://git.kernel.org/stable/c/af3fe52fd108fd38235e4813df62442ed0f1d8ff

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy