CVE-2026-98441: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98441 Overview

CVE-2026-98441 is a use-after-free [CWE-416] vulnerability in the Linux kernel's net/sched subsystem, specifically within the act_ct connection tracking action. The flaw affects how the kernel handles cloned socket buffers (skbs) that reference a shared, unconfirmed conntrack (ct) entry. When two clones process the same unconfirmed entry with different extension sets, the second clone can corrupt an extension pointer previously wired into an expectation list by the first clone. The dangling pointer leads to a use-after-free during destruction. The upstream fix resets the ct entry when act_ct encounters a shared unconfirmed entry, preventing cross-clone extension corruption.

Critical Impact
A local attacker able to influence packet cloning paths through traffic control actions may trigger kernel memory corruption, enabling denial of service or potential privilege escalation.

Affected Products

Linux kernel branches containing the act_ct conntrack helpers introduction (see Fixes tag in referenced commits)
Distributions shipping affected stable kernel series until patches 2b783c5, 4a04ed9, b097d9d, c812bb4, and f85009d are backported
Systems using tc (traffic control) with act_ct and conntrack NAT or label commits

Discovery Timeline

2026-10-18 - CVE-2026-98441 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98441

Vulnerability Analysis

The vulnerability resides in the act_ct traffic control action, which integrates netfilter connection tracking into the Linux tc subsystem. When an skb carrying an unconfirmed ct entry is cloned, both clones can re-enter conntrack processing. The first clone may invoke helpers that attach extension pointers into the conntrack expectation list. If confirmation subsequently fails, the entry remains unconfirmed but still carries wired-up extension state.

The second clone then re-processes the same entry and attempts to commit labels or perform Network Address Translation (NAT). This triggers reallocation of the extension area, invalidating the pointer the first clone registered. On teardown, the stale pointer is dereferenced, producing a use-after-free condition in kernel memory.

Unlike the openvswitch module, act_ct permits NAT without an explicit commit flag. Changing that behavior would break the user API, so the fix resets the entry on NAT regardless of the commit flag.

Root Cause

The root cause is unsafe sharing of a mutable, unconfirmed conntrack entry across cloned skbs. Extension pointers wired by one processing path are invalidated when another path reallocates the extension area, leaving dangling references in the expectation list.

Attack Vector

Exploitation requires local traffic generation through a network pipeline configured with act_ct where the same unconfirmed ct entry is processed by multiple skb clones in the same zone without intermediate header or zone changes. While upstream maintainers note no sensible production pipeline exhibits this pattern, a malicious local user with sufficient privileges to configure traffic control rules can craft the condition. Technical details are available in the referenced kernel commit b097d9d.

Detection Methods for CVE-2026-98441

Indicators of Compromise

Kernel oops or panic messages referencing nf_ct_ext, act_ct, or conntrack expectation list operations
KASAN use-after-free reports naming nf_conntrack destruction paths
Unexplained kernel crashes on hosts running tc filters with action ct and NAT or label commits

Detection Strategies

Audit running kernels against patched stable commits 2b783c5, 4a04ed9, b097d9d, c812bb4, and f85009d
Inventory hosts using tc filter show to identify action ct usage, especially combined with NAT or commit label
Enable KASAN on test kernels to surface the use-after-free during fuzzing of act_ct paths

Monitoring Recommendations

Forward kernel ring buffer (dmesg) and /var/log/kern.log to a centralized logging platform for crash signature correlation
Alert on repeated conntrack-related kernel warnings on the same host within short windows
Track kernel package versions across the fleet and flag hosts missing the stable backport

How to Mitigate CVE-2026-98441

Immediate Actions Required

Apply the vendor-provided kernel update containing one of the referenced stable commits
Reboot affected systems after kernel package upgrade to activate the patched image
Restrict CAP_NET_ADMIN to trusted administrators to limit who can configure act_ct traffic control rules

Patch Information

The fix is distributed across multiple stable branches. Reference commits: Kernel Commit 2b783c5, Kernel Commit 4a04ed9, Kernel Commit b097d9d, Kernel Commit c812bb4, and Kernel Commit f85009d. The patch resets the ct entry when act_ct detects a shared unconfirmed entry and forces reset on NAT regardless of the commit flag.

Workarounds

Remove action ct entries that combine NAT or commit label operations from traffic control configurations where feasible
Avoid network pipelines that process the same packet twice through conntrack before and after cloning without header or zone changes
Reduce exposure by denying unprivileged user namespaces where kernel policy allows, limiting the surface for crafting tc configurations

bash

# Verify running kernel version and confirm patch application
uname -r

# Enumerate act_ct usage across tc filters on all interfaces
for dev in $(ls /sys/class/net/); do
  tc filter show dev "$dev" 2>/dev/null | grep -i "action ct" && echo "[act_ct found on $dev]"
done

# Restrict CAP_NET_ADMIN via sysctl where user namespaces are not required
sysctl -w kernel.unprivileged_userns_clone=0