Linux Kernel EUVD-2026-39218

Exploitation requires the ability to load an nftables ruleset that combines a conntrack template-creating expression ('ct zone set', which calls nf_ct_tmpl_alloc) with a subsequent conntrack get expression ('ct original/reply saddr/daddr') in the same chain on the same packet path - that specific expression combination IS the trigger. This needs CAP_NET_ADMIN in the relevant network namespace, so the attacker must be local root or an unprivileged local user on a system that permits unprivileged user+network namespace creation (PR:L in the CVSS vector). Limiting factors: it is local-only (no network reachability, AV:L), requires the netfilter conntrack module to be available/loaded, and is gated by namespace/capability policy - hosts that block unprivileged user namespaces or withhold CAP_NET_ADMIN from untrusted workloads are not exploitable by non-root users.

Signals are consistent and point to a genuine but locally-scoped issue. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U, C:H/I:H/A:H, base 7.8) reflects local access with low privileges and high impact across confidentiality, integrity and availability - consistent with kernel stack corruption that can be steered toward privilege escalation. EPSS is low (0.16%, 6th percentile) and the vulnerability is NOT on CISA KEV, indicating no observed mass exploitation. The 'low privileges' (PR:L) requirement is meaningful: loading nftables rules requires CAP_NET_ADMIN, obtainable by root or by an unprivileged user inside a user+network namespace where these are allowed. There is no signal conflict: a local-only attack vector with a low EPSS and no KEV status means this should be patched as part of routine kernel maintenance rather than treated as an emergency, with priority raised on multi-tenant or container hosts that permit unprivileged user namespaces.

A local user (or a process inside a container with CAP_NET_ADMIN, e.g. via an unprivileged user namespace) loads an nftables ruleset that first sets a conntrack zone and then reads ct original saddr in the same chain. Processing a packet through the chain causes the kernel to copy attacker-influenced bytes past struct nft_regs on the stack, corrupting kernel memory; with a register such as NFT_REG32_15 this overflows the structure, and a crafted layout can be leveraged for privilege escalation rather than just a crash. A syzkaller reproducer for the crash already exists publicly, though no weaponized exploit was identified at time of analysis.