Linux kernel EUVD-2026-103730

Requires a Linux host running the Open vSwitch kernel datapath with the conntrack action AND a connection-tracking helper (ALG, e.g. FTP/SIP) enabled - not a default configuration. The use-after-free is reachable only for connections that are not yet confirmed, where additional conntrack extensions are added after the helper has stored a raw pointer into the master's expectations list, and only when the extension store is reallocated so the stored pointer becomes stale before the expectation is removed. Limiting factors: the specific OVS+helper configuration, a kernel in the affected range (based on 4.3 through the branch points fixed in 6.12.112/6.18.55/7.2.9/7.3-rc5), and winning the realloc timing window; hosts without OVS conntrack helpers are not exposed. Authentication is not required at the packet level (PR:N), but reachability depends on the attacker being able to send traffic through the affected OVS conntrack path.

Signals conflict and should be weighed carefully. The input CVSS is 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H), but this is the auto-generated score the Linux kernel CNA applies to nearly all kernel fixes and almost certainly overstates real-world risk: the flaw is a use-after-free confined to the Open vSwitch conntrack path and is only reachable when OVS conntrack with connection-tracking helpers (ALGs) is configured - not a default kernel configuration. Supporting that, EPSS is only 0.20% (9th percentile), indicating very low predicted exploitation, and there is no CISA KEV listing and no public exploit identified at time of analysis (the only references are the kernel git fix commits, not PoC code). The vuln.today 'act_now' decision label conflicts with the low EPSS and absence of KEV/PoC; that label appears driven by the raw 9.8 rather than by observed exploitation, so treat it as patch-management priority for affected OVS hosts rather than evidence of active attack. Net assessment: a genuinely serious memory-corruption bug for the specific population running OVS conntrack helpers, but for the general Linux fleet this is a high-CVSS, low-real-world-likelihood issue absent that configuration. The CVSS AV:N/AC:L also understates the timing/config dependency described below - verify applicability against your OVS deployment.

On a host using the Open vSwitch kernel datapath with conntrack and a connection-tracking helper (e.g., an ALG) enabled, an attacker sends traffic that creates an as-yet-unconfirmed tracked connection; the helper wires a raw pointer to the extension area into the expectations list, and a subsequent extension add reallocates that area, leaving a dangling pointer that is later dereferenced when the expectation is removed. The result is a kernel use-after-free leading at minimum to a crash and potentially to memory corruption. No public exploit code is available, and the exact triggering sequence and any weaponized primitive are not described in the available sources.