CVE-2026-52970 Overview
CVE-2026-52970 is a memory leak vulnerability in the Linux kernel's netfilter subsystem, specifically within the nft_ct (nftables connection tracking) module. The flaw resides in nft_ct_expect_obj_eval(), which allocates a connection tracking expectation and may invoke nf_ct_expect_related(), but fails to release its local reference before returning. Each invocation of the affected code path leaks an expectation object, gradually exhausting kernel memory on systems using nftables expectation objects. The issue has been resolved upstream by adding a balancing nf_ct_expect_put(exp) call before the function returns.
Critical Impact
Repeated evaluation of nftables connection tracking expectation objects leaks kernel memory, potentially leading to resource exhaustion on long-running systems.
Affected Products
- Linux kernel versions containing the nft_ct expectation object evaluation code prior to the fix
- Distributions shipping affected stable kernel branches referenced in the upstream commits
- Systems using nftables rulesets that define ct expectation objects
Discovery Timeline
- 2026-06-24 - CVE-2026-52970 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52970
Vulnerability Analysis
The vulnerability is a reference counting error in the nft_ct_expect_obj_eval() function inside the Linux kernel netfilter nft_ct module. The function allocates a struct nf_conntrack_expect object to register a new expected connection associated with an existing tracked flow. After allocation, it may call nf_ct_expect_related() to register the expectation with the connection tracking subsystem. The allocation increments the reference counter on the expectation object, and nf_ct_expect_related() takes its own reference when registration succeeds.
The defect is that the function never drops the local reference acquired during allocation. Each successful evaluation of an ct expectation rule leaves one expectation object reference outstanding. Over time, this accumulates leaked objects in the SLAB allocator, consuming non-swappable kernel memory.
Root Cause
The root cause is missing cleanup of a locally held reference in an error-free code path. The allocation flow returns the caller-held reference that must be released with nf_ct_expect_put() once the caller no longer needs it. The original implementation omitted this call, breaking the reference balance.
Attack Vector
Exploitation requires the ability to trigger evaluation of an nftables ruleset containing ct expectation objects. On systems where such rules are loaded and traffic repeatedly causes them to evaluate, kernel memory will leak proportionally to the volume of matching traffic. Sustained traffic targeting these rules can degrade system performance and eventually cause out-of-memory conditions affecting kernel allocations.
No specific exploitation code is required beyond generating traffic that matches the affected rule path. See the upstream commit references for the precise code changes implementing the fix.
Detection Methods for CVE-2026-52970
Indicators of Compromise
- Steady, unexplained growth of the nf_conntrack_expect SLAB cache visible via /proc/slabinfo
- Increasing kernel memory usage reported in /proc/meminfo under Slab and SUnreclaim without corresponding workload growth
- Allocation failures or OOM events on hosts running nftables rulesets that define ct expectation objects
Detection Strategies
- Compare running kernel version against the fixed commits listed in the kernel.org stable tree to confirm exposure
- Inspect active nftables configuration with nft list ruleset for ct expectation object usage
- Monitor SLAB cache growth for the nf_conntrack_expect slab over time and correlate with traffic processed by expectation rules
Monitoring Recommendations
- Establish a baseline for nf_conntrack_expect slab object counts and alert on sustained upward drift
- Track kernel slab memory metrics in host telemetry pipelines and dashboards
- Audit nftables rule deployments through configuration management so unexpected ct expectation rules are flagged for review
How to Mitigate CVE-2026-52970
Immediate Actions Required
- Identify Linux hosts running affected kernel versions using nftables ct expectation objects
- Schedule kernel updates to a stable release that includes the upstream fix referenced in the kernel git commits
- Reboot affected hosts after patching to load the corrected kernel image
Patch Information
The fix adds a missing nf_ct_expect_put(exp) call before nft_ct_expect_obj_eval() returns, balancing the allocation. The change is available in the following upstream commits: Kernel Commit 19f94b6f, Kernel Commit 1dced072, Kernel Commit 26ab32ec, Kernel Commit 2aef1b13, Kernel Commit 7b96242c, Kernel Commit 84c422ce, Kernel Commit cdb9a25d, and Kernel Commit ecca618e. Apply the appropriate stable kernel release for your distribution.
Workarounds
- Remove or avoid loading nftables rulesets that define ct expectation objects until the kernel is patched
- Periodically reload nftables rulesets or reboot affected hosts to reclaim leaked kernel memory as a short-term measure
- Restrict the ability to install nftables rules to trusted administrators through standard Linux capability controls
# Verify whether nftables ct expectation objects are configured
sudo nft list ruleset | grep -E 'ct expectation|type ct expectation'
# Check kernel version and applied patches
uname -r
# Observe nf_conntrack_expect slab usage
grep nf_conntrack_expect /proc/slabinfo
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
