CVE-2026-31665: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31665 Overview

CVE-2026-31665 is a use-after-free vulnerability in the Linux kernel's netfilter subsystem, specifically within the nft_ct connection tracking timeout object handling. The vulnerability occurs in the nft_ct_timeout_obj_destroy() function, which frees the timeout object using kfree() immediately after calling nf_ct_untimeout(), without waiting for an RCU (Read-Copy-Update) grace period. This premature deallocation allows concurrent packet processing on other CPUs to access freed memory through RCU-protected references obtained via rcu_dereference() in nf_ct_timeout_data().

Critical Impact
Local attackers with limited privileges can exploit this race condition to potentially achieve privilege escalation, information disclosure, or cause system crashes through memory corruption.

Affected Products

Linux Kernel version 4.19
Linux Kernel versions 7.0-rc1 through 7.0-rc7
Linux Kernel (multiple stable branches)

Discovery Timeline

April 24, 2026 - CVE-2026-31665 published to NVD
April 27, 2026 - Last updated in NVD database

Technical Details for CVE-2026-31665

Vulnerability Analysis

This use-after-free vulnerability (CWE-416) exists in the netfilter nftables connection tracking subsystem. The core issue stems from improper synchronization between the destruction of timeout objects and concurrent packet processing that may still hold references to those objects.

When nft_ct_timeout_obj_destroy() is invoked during rule cleanup or table destruction, it calls nf_ct_untimeout() to disassociate the timeout from active connections and then immediately frees the memory with kfree(). However, the RCU mechanism used by the kernel for safe concurrent access requires a grace period before memory can be safely reclaimed. During this window, other CPUs processing network packets may still be iterating through the connection tracking data structures and holding valid RCU-read-side references to the now-freed timeout object.

The KASAN (Kernel Address Sanitizer) report included in the kernel commit reveals the exploitation pattern: a process executing TCP packet handling via nf_conntrack_tcp_packet() attempts to read from memory at offset 0x19c of a previously freed timeout object structure, triggering a slab-use-after-free condition.

Root Cause

The root cause is a missing RCU grace period between the call to nf_ct_untimeout() and the freeing of the timeout object memory. The struct nf_ct_timeout lacked an rcu_head member necessary for deferred freeing via kfree_rcu(). This design oversight created a race condition where the timeout object could be freed while still being accessed by RCU-protected readers on other CPUs during packet processing.

Attack Vector

Exploitation requires local access with the ability to manipulate nftables rules containing connection tracking timeout objects. An attacker could trigger this vulnerability by:

Creating nftables rules with connection tracking timeout objects
Initiating network traffic that causes the kernel to reference these timeout objects during packet processing
Simultaneously destroying the nftables rules, triggering the premature freeing of timeout objects
Racing the destruction against active packet processing to achieve use-after-free

The KASAN report shows the memory was allocated in nft_ct_timeout_obj_init() during rule creation via nf_tables_newobj(), and freed in nft_obj_destroy() during transaction cleanup via nf_tables_trans_destroy_work(). The freed memory was then accessed during TCP packet processing through the nf_conntrack_tcp_packet() path.

Detection Methods for CVE-2026-31665

Indicators of Compromise

KASAN reports indicating slab-use-after-free in nf_conntrack_tcp_packet or related netfilter functions
Kernel oops or panics with call traces involving nft_ct_timeout, nf_ct_timeout_data, or nf_conntrack_in
Unexpected system crashes during nftables rule modification or table deletion
Memory corruption artifacts in kernel logs referencing netfilter connection tracking components

Detection Strategies

Enable KASAN in development/testing kernels to detect use-after-free conditions
Monitor kernel logs for oops messages involving netfilter and connection tracking functions
Deploy kernel crash dump analysis to identify exploitation attempts through call trace analysis
Use lockdep and other kernel debugging features to identify RCU usage violations

Monitoring Recommendations

Implement centralized kernel log collection and analysis for production systems
Alert on kernel oops or panic events, particularly those referencing netfilter subsystem functions
Monitor for unusual nftables rule manipulation patterns that could indicate exploitation attempts
Track process executions that interact with nftables while generating high network traffic

How to Mitigate CVE-2026-31665

Immediate Actions Required

Update the Linux kernel to a patched version containing the fix commits
Restrict access to nftables administration to trusted users and processes
Review and limit CAP_NET_ADMIN capabilities in containerized environments
Consider using SELinux or AppArmor policies to restrict netfilter manipulation capabilities

Patch Information

The Linux kernel maintainers have released fixes across multiple stable branches. The fix adds an rcu_head to struct nf_ct_timeout and replaces the direct kfree() call with kfree_rcu() to properly defer memory deallocation until after an RCU grace period. This approach matches the existing implementation in nfnetlink_cttimeout.c.

Patch commits are available from the kernel Git repository:

Workarounds

Restrict access to nftables management interfaces using capabilities and mandatory access controls
Disable nftables connection tracking timeout objects if not operationally required
Implement network namespace isolation to limit exposure in multi-tenant environments
Monitor for and prevent rapid creation/deletion of nftables rules with timeout objects

bash

# Restrict nftables access to root only and specific administrators
# Review processes with CAP_NET_ADMIN capability
getcap -r / 2>/dev/null | grep cap_net_admin

# Check for loaded nft_ct module
lsmod | grep nft_ct

# Verify kernel version includes the fix
uname -r