CVE-2026-98442: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98442 Overview

CVE-2026-98442 is a use-after-free vulnerability in the Linux kernel's net/sched subsystem, specifically within the act_ct connection tracking action. The flaw resides in the netfilter conntrack helper flow, where a raw pointer to the extensions memory area is stored in the expectations list before the connection is confirmed. Subsequent calls to *_ext_add() reallocate the extension space, leaving a dangling pointer that is later dereferenced when the expectation is removed. The vulnerability was resolved by ensuring helpers are invoked after all other extensions have been added.

Critical Impact
Use-after-free conditions in kernel networking paths can lead to memory corruption, kernel crashes, and in some configurations, local privilege escalation.

Affected Products

Linux Kernel (net/sched act_ct component)
Distributions shipping affected stable kernel branches
Systems using netfilter connection tracking helpers with traffic classifier actions

Discovery Timeline

2026-10-18 - CVE-2026-98442 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98442

Vulnerability Analysis

The vulnerability occurs inside the netfilter conntrack helper invocation chain used by the act_ct traffic control action. When nf_ct_helper() runs, it calls helper->help(), which may call nf_ct_expect_related_report() and then nf_ct_expect_insert(). The insertion function links the expectation into the master connection's expectations list using hlist_add_head_rcu(&exp->lnode, &master_help->expectations). The problem is that exp references memory inside the conntrack extensions area, and that pointer is retained in the kernel data structure.

If the connection has not yet been confirmed, additional extensions may be appended afterward through *_ext_add() helpers. These calls can reallocate the extensions block, invalidating the previously stored pointer. The stale reference remains in the expectations list and is dereferenced when the expectation is later removed, producing the use-after-free condition [CWE-416].

Root Cause

The root cause is an ordering bug: helpers that register expectations run before all extensions have been added to the conntrack entry. Because extension memory is dynamically grown through reallocation, any pointer captured prior to the final extension addition can become invalid. The fix reorders operations so helper invocation occurs after all extensions are attached, preventing reallocation from happening while a raw pointer is wired into a live list.

Attack Vector

Exploitation requires the ability to influence traffic processed by a tc act_ct action on a system with conntrack helpers enabled. Crafted network traffic matching a helper such as FTP or SIP can trigger the vulnerable code path. Successful triggering corrupts kernel memory when the expectation is torn down, potentially causing a kernel panic or enabling further memory corruption primitives. The vulnerability lives in networking fast paths, so remote traffic sourcing is possible on exposed systems.

Detection Methods for CVE-2026-98442

Indicators of Compromise

Unexpected kernel oops or panic messages referencing nf_ct_expect, nf_conntrack_helper, or act_ct in dmesg or /var/log/kern.log
KASAN splats reporting use-after-free in nf_ct_remove_expect or related expectation teardown paths
Unexplained reboots on hosts running tc rules that attach act_ct actions with helper modules loaded

Detection Strategies

Audit running kernels against the fixed stable commits (1679bbf, 31f5fe2, 812c16a, 8988f4d, dad19b5) to confirm the patch is present
Enumerate loaded conntrack helper modules (nf_conntrack_ftp, nf_conntrack_sip, nf_conntrack_h323, nf_conntrack_pptp) and systems using tc action add action ct rules
Enable KASAN on test kernels to surface the UAF deterministically during fuzzing of helper-triggering traffic

Monitoring Recommendations

Forward kernel ring buffer and auditd events to a centralized log pipeline and alert on conntrack-related oops signatures
Monitor host availability and sudden reboot patterns on edge routers, firewalls, and Kubernetes nodes where act_ct is used for connection tracking offload
Track package versions across the fleet to confirm uniform rollout of patched kernels

How to Mitigate CVE-2026-98442

Immediate Actions Required

Apply the upstream Linux kernel fixes referenced in the stable tree commits and reboot affected hosts
Prioritize patching on systems that run tc act_ct actions, container hosts using conntrack offload, and network gateways
Validate distribution vendor advisories for backported fixes to long-term support kernel series

Patch Information

The fix reorders helper invocation to occur after all conntrack extensions are added, eliminating the stale pointer scenario. Patched commits are available in the stable Linux kernel tree: Linux Kernel Commit 1679bbf, Linux Kernel Commit 31f5fe2, Linux Kernel Commit 812c16a, Linux Kernel Commit 8988f4d, and Linux Kernel Commit dad19b5.

Workarounds

Remove or avoid tc rules that attach act_ct actions where feasible until patched kernels are deployed
Unload conntrack helper modules that are not strictly required using modprobe -r nf_conntrack_ftp and similar commands
Restrict ingress traffic that would otherwise trigger protocol-specific helpers at upstream firewalls

bash

# Verify running kernel version and check for the fix
uname -r

# List loaded conntrack helper modules
lsmod | grep nf_conntrack

# Enumerate tc rules referencing the act_ct action
for dev in $(ls /sys/class/net); do
  tc filter show dev "$dev" 2>/dev/null | grep -i act_ct && echo "found on $dev"
done

# Temporarily unload a non-essential helper (example: FTP)
sudo modprobe -r nf_conntrack_ftp