Linux Kernel EUVD-2026-93305

The affected host must have a netfilter/nftables flowtable configured (the software/hardware fastpath that offloads established connections), because the bug lives in the flowtable's handling of conntrack references - it is not present on systems not using flowtable offload. The CVSS vector (AV:L/PR:L) means a local, authenticated low-privileged user is required; it is not remotely reachable without a foothold. Exploitation is further limited by being a race condition against the RCU grace period (the flowtable must hold a reference to a conntrack whose ext area is freed), so reliable triggering requires winning a timing window, and the host must be running an unpatched kernel in the listed ranges (e.g. before 6.1.189, 6.6.158, 6.12.112, 5.10.271, 5.15.222, etc.).

This is a use-after-free in the Linux kernel netfilter flowtable datapath: nf_ct_put() frees the conntrack ext area immediately while the flowtable can still reference the (wrong) conntrack through RCU-typesafe semantics. The supplied CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 HIGH) indicates a local, low-privilege attacker with full C/I/A impact - consistent with kernel memory corruption. However, the real-world exploitation signals are notably low: EPSS is 0.22% (11th percentile), the issue is NOT in CISA KEV, and no POC is referenced in the provided data. Exploitation status: no public exploit identified at time of analysis. There is tension between the HIGH CVSS and the low EPSS/absence of KEV - this is characteristic of a serious-but-not-yet-weaponized kernel race that requires local access and a specific netfilter configuration, rather than a mass-exploited, remotely reachable bug. One signal conflict to flag explicitly: the input Tags label this 'Information Disclosure', but the technical nature (use-after-free referencing freed conntrack ext) and the C:H/I:H/A:H vector imply impact well beyond disclosure, including potential privilege escalation or kernel compromise. Overall: a legitimate patch-worthy local-escalation-class issue, but a moderate operational priority absent evidence of active exploitation.

A local, low-privileged user on a host that uses an nftables flowtable (software fastpath) sets up and tears down network flows to race conntrack teardown against the flowtable's RCU reference, triggering access to a freed conntrack extension. By grooming kernel memory to control the freed object, the attacker leverages the use-after-free to leak kernel memory or corrupt state for privilege escalation. No public exploit code is referenced in the provided data, and exploitation requires winning an RCU-timed race.