EUVD-2026-103682
GHSA-cqvg-rqhw-9mqj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain local access with net-admin capability
-
DeliveryConfigure tc act_ct with conntrack helper
-
ExploitTrigger helper on unconfirmed connection
-
ExecutionExtension realloc leaves dangling pointer
-
PersistAccess freed pointer removing expectation
-
ImpactKernel use-after-free and memory corruption
Vulnerability Assessment
| Exploitation Conditions | Exploitation requires the tc act_ct (connection tracking) action to be in use with a conntrack helper (e.g. an ALG helper) configured, and the vulnerable path is reached specifically for connections that are not yet confirmed, where additional extensions are added after the helper runs, reallocating the extension space and invalidating the pointer stored in the expectations list. Limiting factors: the attacker needs local access and sufficient privilege to drive this configuration/traffic (CVSS PR:L; configuring tc act_ct typically needs CAP_NET_ADMIN, obtainable within a user namespace on some deployments), there is no remote or unauthenticated vector (AV:L), and systems not using act_ct with helpers are not exposed. The precise triggering interleaving beyond the ordering described (helper called before all other extensions are added) is not elaborated in the available sources. |
| Impact | The CVSS base score of 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a high-impact local kernel use-after-free, but the real-world signals point to a priority-but-not-emergency issue rather than a widely-exploited flaw. The vector is explicitly local (AV:L) and requires existing privileges (PR:L) - exploitation is not remote or unauthenticated. EPSS is very low at 0.17% (6th percentile), there is no CISA KEV listing (no active exploitation confirmed), and no public exploit was identified in the provided data; these three signals are mutually consistent and argue against opportunistic mass exploitation. The vuln.today decision label 'this_week' aligns with that reading: patch promptly on a normal cycle, not an out-of-band emergency. The SSVC framework fields (automatable, technical impact, exploitation status) were not supplied, so a full SSVC decision cannot be reconstructed from the input. Net: a genuine local privilege-escalation/memory-corruption risk worth patching within the normal maintenance window, most relevant to multi-tenant or untrusted-local-user kernels where act_ct is in use, but not an indicator of broad in-the-wild activity. |
| Exploit ScenarioDerived | A local actor able to configure traffic-control connection tracking (tc act_ct) with a conntrack helper sends traffic over a not-yet-confirmed connection so the helper is invoked and wires a raw pointer to the extension area into the expectations list; subsequent *_ext_add() calls reallocate the extension space, and the stale pointer is later dereferenced when the expectation is removed, producing a kernel use-after-free. Because AV:L/AC:L/PR:L, this requires local access and privileges to set up the act_ct path but no user interaction. No public exploit code was identified in the provided data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Use-after-free in the Linux kernel's net/sched act_ct action allows a local user with low privileges (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) to corrupt kernel memory, with high confidentiality, integrity and availability impact (base score 7.8). The flaw only surfaces when act_ct is combined with a conntrack helper (such as an ALG helper) and the affected connection has not yet been confirmed, so unconfirmed flows that gain further conntrack extensions after the helper runs leave a stale pointer in the expectations list. There is no remote or unauthenticated vector, no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.17% (6th percentile); the vulnerability is nonetheless patched in stable trees and is prioritised for remediation this week rather than treated as an emergency.
RemediationAI
Apply the vendor-released kernel update: fixed versions are 6.18.55, 7.2.9 and 6.12.112, with 7.3-rc5 as the mainline release that contains the change; distribution kernels should be updated to a build carrying stable commits 1679bbf5fbeac52a310b1a58b2b301bbf388bdbf, 812c16a255e7773a544e88b39ae6daed25544d30, 8988f4d11f3fba0ab38122178836c683ad516a05 and dad19b59da050cb60d3f7023dac2a042a84bf0bd, which are viewable at https://git.kernel.org/stable/c/1679bbf5fbeac52a310b1a58b2b301bbf388bdbf, https://git.kernel.org/stable/c/8988f4d11f3fba0ab38122178836c683ad516a05 and https://git.kernel.org/stable/c/dad19b59da050cb60d3f7023dac2a042a84bf0bd. Because exploitation requires local low-privilege access plus a live act_ct configuration that uses conntrack helpers on unconfirmed connections, hosts that do not run act_ct with helpers are not exposed and can be scheduled after the affected nodes; plan the update as a this-week change rather than an emergency restart. Where the patched kernel cannot be deployed immediately, exposure can be reduced by not configuring act_ct together with conntrack helpers on the affected systems, and by treating act_ct configuration privileges (typically CAP_NET_ADMIN, obtainable inside user namespaces on some deployments) as trust boundaries, since whoever can drive that configuration and traffic controls reachability of the flawed path. No public exploit code has been identified, so the immediate risk driver is the reachable local privilege boundary rather than observed attacks.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
net/sched act_ct is the tc action that attaches netfilter connection tracking to traffic steered by the qdisc classifier. On the conntrack side, a connection's metadata lives in a separately allocated extensions area that can be grown and therefore reallocated by subsequent *_ext_add() calls while the connection is still unconfirmed. When a helper is invoked via nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert(), the expectation is linked into master_help->expectations with hlist_add_head_rcu() using a raw pointer into that extension area. If additional extensions are added afterwards the extension space is reallocated, the pointer held in the expectation list becomes dangling, and it is dereferenced when the expectation is later removed - a use-after-free of kernel memory. The upstream resolution reorders the logic so helpers are called only after all other extensions have been added, eliminating the window in which the list can hold an invalid pointer; the commit notes that helper rejection now leaves mark and labels set, mirroring pre-existing NAT and confirmation-failure behaviour, and that the API never provided atomicity guarantees. The trigger beyond this ordering condition (the specific interleaving needed to reach the reallocation while the expectation is still queued) is not elaborated in the available sources, and no CWE identifier was assigned in the supplied data.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local kernel path reachable only with privileges to configure act_ct (AV:L, PR:L); a use-after-free yields memory corruption with full confidentiality, integrity and availability impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
4DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: fix helper UAF due to extensions realloc
While calling the helpers, a raw pointer to the extensions area is wired into expectations list:
-> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)
In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation.
Make sure that helpers are called at the end after all the other extensions are already added.
Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway.
Executive ViewAI
A high-severity memory corruption flaw in the Linux kernel's networking component (act_ct) could allow a local user with basic access to compromise entire systems, affecting confidentiality, integrity, and availability. While no public exploit exists and exploitation likelihood is very low, the widespread use of Linux across servers and cloud infrastructure means unpatched systems remain at risk. Leadership should prioritize patching this week to prevent potential privilege escalation and data breaches.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB