Linux Kernel EUVD-2026-103681

Requires the host to use the tc (traffic control) act_ct connection-tracking action, and specifically a path where an skb holding an UNCONFIRMED conntrack entry is cloned and both clones are processed - with the second clone committing labels or performing NAT (act_ct permits NAT without the commit flag, unlike openvswitch). The vulnerability was introduced in Linux 6.2 with the conntrack helper wiring. Limiting factors: AV:L means local triggering only (not remote-internet exploitation); PR:L indicates some privilege is needed (configuring tc/act_ct typically requires CAP_NET_ADMIN); and the vendor states there is 'no practical network pipeline' requiring double-clone processing in the same zone without header/zone changes, so a non-default or contrived conntrack/cloning configuration is effectively required to reach the UAF.

Signals point to a genuine but non-emergency kernel memory-safety issue rather than a mass-exploitation threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) reflects a local use-after-free with high confidentiality, integrity and availability impact - consistent with a kernel UAF that can lead to crash (DoS) or potential privilege escalation. EPSS is very low at 0.17% (6th percentile), and the vulnerability is NOT listed in CISA KEV, so there is no public evidence of active exploitation. The vuln.today decision label is 'this_week', indicating patch-soon prioritization rather than drop-everything urgency, which is coherent with the low EPSS and absence of KEV. There is a notable tension with the description: the vendor explicitly states 'there should be no practical network pipeline' that triggers this without unusual processing of both skb clones in the same zone, implying exploitation requires an atypical/contrived act_ct conntrack configuration - so the real-world AC:L rating may understate the difficulty of reaching the vulnerable code path. Net assessment: legitimate local kernel vulnerability worth patching on the normal stable-update cadence, but not a widespread-exploitation priority on current signals.

On a host using the tc act_ct (connection tracking) action, an attacker or workload capable of influencing network configuration/processing arranges for an skb carrying an unconfirmed conntrack entry to be cloned and processed twice (e.g., committing labels or running NAT on a second clone), corrupting the extension pointer in the expectation list and triggering a use-after-free on the destruction path. The resulting kernel memory corruption can cause a denial of service (panic) and may be leveraged toward local privilege escalation. No public exploit identified at time of analysis; only upstream fix commits and advisory references are available.