CVE-2026-31665 - Vulnerability Details

- netfilter: nft_ct: fix use-after-free in timeout object destroy

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: fix use-after-free in timeout object destroy

nft_ct_timeout_obj_destroy() frees the timeout object with kfree()
immediately after nf_ct_untimeout(), without waiting for an RCU grace
period. Concurrent packet processing on other CPUs may still hold
RCU-protected references to the timeout object obtained via
rcu_dereference() in nf_ct_timeout_data().

Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer
freeing until after an RCU grace period, matching the approach already
used in nfnetlink_cttimeout.c.

KASAN report:
BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0
Read of size 4 at addr ffff8881035fe19c by task exploit/80

Call Trace:
nf_conntrack_tcp_packet+0x1381/0x29d0
nf_conntrack_in+0x612/0x8b0
nf_hook_slow+0x70/0x100
__ip_local_out+0x1b2/0x210
tcp_sendmsg_locked+0x722/0x1580
__sys_sendto+0x2d8/0x320

Allocated by task 75:
nft_ct_timeout_obj_init+0xf6/0x290
nft_obj_init+0x107/0x1b0
nf_tables_newobj+0x680/0x9c0
nfnetlink_rcv_batch+0xc29/0xe00

Freed by task 26:
nft_obj_destroy+0x3f/0xa0
nf_tables_trans_destroy_work+0x51c/0x5c0
process_one_work+0x2c4/0x5a0

Published: 2026-04-24

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug occurs when the nft_ct timeout object is freed by kfree immediately after nf_ct_untimeout without waiting for an RCU grace period. While other CPUs may still reference the object via rcu_dereference, this can lead to a slab use‑after‑free. Based on the KASAN report, it is inferred that malformed or specially crafted packets could trigger the flaw, resulting in memory corruption.

Affected Systems

All Linux kernel releases prior to the patch, including kernel 4.19 and the 7.0 release candidates from RC1 through RC7. The fix is included in later commits referenced in the Linux kernel repository and should be present in subsequent stable releases.

Risk and Exploitability

The CVSS score of 7.8 reflects a high severity vulnerability. The EPSS score of less than 1% suggests that, at the time of analysis, exploitation is unlikely yet. The vulnerability is not listed in the CISA KEV catalog. It is inferred that exploitation might require local privileges or network access that can send specially crafted packets, but the advisory does not provide explicit attack vectors.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< c458fc1c278a65ad5381083121d39a479973ebed
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< c581e5c8f2b59158f62efe61c1a3dc36189081ff
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< f16fe84879a5280f05ebbcea593a189ba0f3e79a
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< 070abdf1b04325b21a20a2a0c39a2208af107275
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< b42aca3660dc2627a29a38131597ca610dc451f9
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< d0983b48c10d1509fd795c155f8b1e832e1369ff
`7e0b2b57f01d183e1c84114f1f2287737358d748`	affected	< f8dca15a1b190787bbd03285304b569631160eda

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`5.10.253`	unaffected	≤ 5.10.*
`5.15.203`	unaffected	≤ 5.15.*
`6.1.169`	unaffected	≤ 6.1.*
`6.6.135`	unaffected	≤ 6.6.*
`6.12.82`	unaffected	≤ 6.12.*
`6.18.23`	unaffected	≤ 6.18.*
`6.19.13`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:4.19:-::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc6::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7e0b2b57f01d183e1c84114f1f2287737358d748,c458fc1c278a65ad5381083121d39a479973ebed)`	affected	code_commit	—
`[7e0b2b57f01d183e1c84114f1f2287737358d748,c581e5c8f2b59158f62efe61c1a3dc36189081ff)`	affected	code_commit	—
`[7e0b2b57f01d183e1c84114f1f2287737358d748,f16fe84879a5280f05ebbcea593a189ba0f3e79a)`	affected	code_commit	—
`[7e0b2b57f01d183e1c84114f1f2287737358d748,070abdf1b04325b21a20a2a0c39a2208af107275)`	affected	code_commit	—
`[7e0b2b57f01d183e1c84114f1f2287737358d748,aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77)`	affected	code_commit	—
`[7e0b2b57f01d183e1c84114f1f2287737358d748,b42aca3660dc2627a29a38131597ca610dc451f9)`	affected	code_commit	—
`[7e0b2b57f01d183e1c84114f1f2287737358d748,d0983b48c10d1509fd795c155f8b1e832e1369ff)`	affected	code_commit	—
`[7e0b2b57f01d183e1c84114f1f2287737358d748,f8dca15a1b190787bbd03285304b569631160eda)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.19`	affected	generic	—
`[0,4.19)`	unaffected	generic	—
`[5.10.253,5.11.0)`	unaffected	generic	—
`[5.15.203,5.16.0)`	unaffected	generic	—
`[6.1.169,6.2.0)`	unaffected	generic	—
`[6.6.135,6.7.0)`	unaffected	generic	—
`[6.12.82,6.13.0)`	unaffected	generic	—
`[6.18.23,6.19.0)`	unaffected	generic	—
`[6.19.13,6.20.0)`	unaffected	generic	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the kernel patch that defers freeing the nft_ct timeout object until after an RCU grace period, thereby eliminating the use‑after‑free (CWE‑416) and race condition (CWE‑825) weaknesses.
Reboot or resume the updated kernel to ensure the patch takes effect.
If upgrading immediately is not possible, temporarily tighten nftables rules to filter or drop malformed packets that could trigger nf_conntrack, reducing the risk of exploitation until the kernel is updated.

Generated by OpenCVE AI on April 29, 2026 at 02:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/070abdf1b04325b21a20a2a0c39a2208af107275
https://git.kernel.org/stable/c/aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77
https://git.kernel.org/stable/c/b42aca3660dc2627a29a38131597ca610dc451f9
https://git.kernel.org/stable/c/c458fc1c278a65ad5381083121d39a479973ebed
https://git.kernel.org/stable/c/c581e5c8f2b59158f62efe61c1a3dc36189081ff
https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff
https://git.kernel.org/stable/c/f16fe84879a5280f05ebbcea593a189ba0f3e79a
https://git.kernel.org/stable/c/f8dca15a1b190787bbd03285304b569631160eda
https://lore.kernel.org/linux-cve-announce/2026042405-CVE-2026-31665-f586@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31665
https://www.cve.org/CVERecord?id=CVE-2026-31665

History

Mon, 27 Apr 2026 20:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:4.19:-:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc6:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc7::::::

Mon, 27 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 25 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026042405-CVE-2026-31665-f586@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31665 https://www.cve.org/CVERecord?id=CVE-2026-31665
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Fri, 24 Apr 2026 15:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix use-after-free in timeout object destroy nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data(). Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c. KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80 Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320 Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00 Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0
Title		netfilter: nft_ct: fix use-after-free in timeout object destroy
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/070abdf1b04325b21a20a2a0c39a2208af107275 https://git.kernel.org/stable/c/aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77 https://git.kernel.org/stable/c/b42aca3660dc2627a29a38131597ca610dc451f9 https://git.kernel.org/stable/c/c458fc1c278a65ad5381083121d39a479973ebed https://git.kernel.org/stable/c/c581e5c8f2b59158f62efe61c1a3dc36189081ff https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff https://git.kernel.org/stable/c/f16fe84879a5280f05ebbcea593a189ba0f3e79a https://git.kernel.org/stable/c/f8dca15a1b190787bbd03285304b569631160eda

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-24T14:45:14.613Z

Updated: 2026-05-11T22:13:13.182Z

Reserved: 2026-03-09T15:48:24.129Z

Link: CVE-2026-31665

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-24T15:16:46.157

Modified: 2026-04-27T20:00:05.430

Link: CVE-2026-31665

Redhat

Severity : Moderate

Publid Date: 2026-04-24T00:00:00Z

Links: CVE-2026-31665 - Bugzilla

OpenCVE Enrichment

Updated: 2026-04-29T02:30:07Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object