Skip to main content

Linux Kernel EUVDEUVD-2026-25558

| CVE-2026-31665 HIGH
Use After Free (CWE-416)
2026-04-24 Linux GHSA-m7w2-jxf2-6j36
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local UAF needing CAP_NET_ADMIN (PR:L) and winning a concurrency race between destroy and packet processing (AC:H), with high memory-corruption impact on confidentiality, integrity and availability.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:26 vuln.today
Patch released
Apr 27, 2026 - 20:00 nvd
Patch available
CVSS changed
Apr 27, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25558
CVE Published
Apr 24, 2026 - 14:45 nvd
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: fix use-after-free in timeout object destroy

nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data().

Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c.

KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80

Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320

Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00

Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0

AnalysisAI

Local privilege escalation and memory corruption in the Linux kernel's netfilter nf_tables conntrack (nft_ct) subsystem allows a local user with network-admin capability to trigger a use-after-free by destroying a conntrack timeout object while packets on other CPUs still reference it. The flaw stems from nft_ct_timeout_obj_destroy() calling kfree() immediately after nf_ct_untimeout() without waiting for an RCU grace period, leaving a dangling RCU-protected pointer read during nf_conntrack_tcp_packet(). No public exploit identified at time of analysis, and EPSS is very low (0.02%, 7th percentile), but a KASAN reproducer ('exploit' task) is described in the commit and the bug is a classic exploitable CWE-416 heap UAF.

Technical ContextAI

The affected component is the Linux kernel netfilter/nf_tables framework, specifically the conntrack timeout policy object (struct nf_ct_timeout) managed by net/netfilter/nft_ct.c. nf_tables allows an administrator to define custom connection-tracking timeout policies as stateful objects; packet-processing hooks retrieve the active timeout via rcu_dereference() inside nf_ct_timeout_data() and dereference it in protocol handlers such as nf_conntrack_tcp_packet(). The root cause (CWE-416, use-after-free) is a missing RCU grace period: the destroy path frees the object synchronously with kfree() while concurrent softirq packet processing on other CPUs still holds RCU-protected references. The fix adds an rcu_head to struct nf_ct_timeout and switches to kfree_rcu(), deferring the free until all RCU readers finish - the same pattern already used in nfnetlink_cttimeout.c. Per the CPE data the scope is the generic Linux kernel (cpe:2.3:a:linux:linux:*), affecting any build with nf_tables conntrack timeout support (CONFIG_NFT_CT / CONFIG_NF_CONNTRACK_TIMEOUT).

RemediationAI

Vendor-released patch: upgrade to a fixed kernel - 5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13, or 7.0, matching your stable branch; the upstream fix (adding rcu_head and using kfree_rcu in nft_ct_timeout_obj_destroy) is carried in the git.kernel.org stable commits (e.g. https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff). Distro users should apply the corresponding packaged kernel: Ubuntu via USN-8567-1 (https://ubuntu.com/security/notices/USN-8567-1) and Siemens appliance operators via SSA-019113 and SSA-082556. Where immediate patching is not possible, reduce exposure to the trigger path: restrict CAP_NET_ADMIN by setting user.max_user_namespaces=0 or kernel.unprivileged_userns_clone=0 to prevent unprivileged users from creating network namespaces where they could add nft_ct timeout objects (trade-off: breaks rootless containers and some sandboxing tools), and where nf_tables custom conntrack timeout policies are unused, avoid loading/using the nft_ct timeout object feature. These controls only shrink the attack surface and are not a substitute for the kernel update.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25558 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy