CVE-2026-31495: Linux Kernel Netfilter Vulnerability

CVE-2026-31495 Overview

CVE-2026-31495 is an input validation vulnerability in the Linux kernel netfilter subsystem, specifically within the ctnetlink connection tracking interface. The flaw stems from incomplete range validation of netlink attributes used to update connection tracking state. A local user with sufficient privileges to issue ctnetlink messages can supply out-of-range values for CTA_PROTOINFO_TCP_WSCALE_ORIGINAL or CTA_PROTOINFO_TCP_WSCALE_REPLY, triggering undefined behavior when the value is later used as a u32 shift count. The fix replaces manual range and mask checks with netlink policy annotations so that the netlink core rejects invalid values early.

Critical Impact
A local privileged user can trigger undefined behavior in TCP connection tracking, resulting in kernel-level denial of service on affected systems.

Affected Products

Linux Kernel (mainline branches prior to the ctnetlink range-check fix)
Linux Kernel 2.6.22 (initial introduction of affected ctnetlink paths)
Linux Kernel 7.0 release candidates rc1 through rc7

Discovery Timeline

2026-04-22 - CVE-2026-31495 published to the National Vulnerability Database
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31495

Vulnerability Analysis

The vulnerability resides in the ctnetlink code paths inside net/netfilter/nf_conntrack_netlink.c. The ctnetlink interface allows userspace to inspect and modify conntrack entries through netlink messages. Several attributes accepted by this interface lacked strict range validation at the netlink policy layer and relied on inline checks that were either incomplete or absent.

The most impactful gap involved the TCP window scale attributes CTA_PROTOINFO_TCP_WSCALE_ORIGINAL and CTA_PROTOINFO_TCP_WSCALE_REPLY. The standard TCP option parser clamps the window scale to TCP_MAX_WSCALE (14), but the ctnetlink path accepted any value in the range 0–255. When that attacker-controlled value was subsequently used as the shift count for a u32 operation, the result was undefined behavior under the C standard, which on Linux manifests as unpredictable kernel state.

Additional missing checks affected CTA_PROTOINFO_TCP_STATE (values above TCP_CONNTRACK_SYN_SENT2), CTA_FILTER_ORIG_FLAGS, CTA_FILTER_REPLY_FLAGS, and CTA_EXPECT_FLAGS, all of which previously depended on manual mask validation.

Root Cause

The root cause is missing netlink policy enforcement on user-supplied attribute values. Inline validation was incomplete for some attributes and entirely absent for the TCP window scale, allowing values that violated kernel invariants to reach code that assumed sanitized input.

Attack Vector

Exploitation requires local access and the privileges necessary to send ctnetlink messages, typically CAP_NET_ADMIN within a user namespace. A local user crafts a netlink message containing an out-of-range CTA_PROTOINFO_TCP_WSCALE_* value and sends it to update a conntrack entry. The kernel then uses the value as a shift count, producing undefined behavior and impacting system availability.

No verified public proof-of-concept code is available. The fix is described in the upstream commits referenced in the Linux kernel stable tree.

Detection Methods for CVE-2026-31495

Indicators of Compromise

Unexpected kernel warnings, soft lockups, or panics referencing nf_conntrack_netlink or TCP conntrack helpers
Audit records showing processes invoking NFNL_SUBSYS_CTNETLINK operations from non-administrative workloads
Unprivileged containers obtaining CAP_NET_ADMIN within a user namespace and immediately issuing conntrack updates

Detection Strategies

Enable kernel auditd rules for the socket and sendmsg system calls filtered on AF_NETLINK with the NETLINK_NETFILTER protocol
Monitor kernel ring buffer output for UBSAN reports referencing shift-count overflow in nf_conntrack_proto_tcp.c
Alert on processes outside expected administrative tooling that open netlink sockets to subsystem NFNL_SUBSYS_CTNETLINK

Monitoring Recommendations

Collect and centralize dmesg output to surface conntrack-related kernel warnings across the fleet
Track container runtime configurations that grant CAP_NET_ADMIN and review whether user namespaces are required
Baseline normal ctnetlink message volume per host and alert on anomalous spikes that may indicate fuzzing or exploitation attempts

How to Mitigate CVE-2026-31495

Immediate Actions Required

Apply the upstream kernel update containing the ctnetlink netlink policy range checks as soon as your distribution publishes it
Audit which workloads hold CAP_NET_ADMIN, especially inside user namespaces, and revoke the capability where not required
Restrict access to the NETLINK_NETFILTER socket family from untrusted containers and multi-tenant workloads

Patch Information

The upstream fix replaces manual validation with NLA_POLICY_MASK and explicit range annotations on the affected attributes. Distribution-shipped kernels should be updated to a build that incorporates the commits referenced in the NVD entry, including commit 2ef71307c86a, commit 435b576cd2fa, and commit fcec5ce2d73a. Consult your distribution's security advisories for the corresponding package versions.

Workarounds

Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where workloads do not require them
Use seccomp profiles to block the socket system call with the AF_NETLINK family for containers that do not need conntrack access
Apply LSM policies (SELinux, AppArmor) that restrict NETLINK_NETFILTER socket creation to administrative domains

bash

# Restrict unprivileged user namespaces to limit reachability of ctnetlink
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' > /etc/sysctl.d/99-cve-2026-31495.conf

# Verify the running kernel after patching
uname -r