CVE-2026-98490: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98490 Overview

CVE-2026-98490 is a use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) connection tracking (conntrack) subsystem. The flaw resides in how netfilter conntrack helpers interact with the extensions area of unconfirmed connections. When a helper runs through nf_ct_helper(), a raw pointer to the extensions area is stored in the expectations list via hlist_add_head_rcu(). Subsequent *_ext_add() calls can reallocate the extension space, leaving a stale pointer in the expectations list. The kernel later dereferences the invalidated pointer when removing the expectation, triggering memory corruption in a privileged kernel path.

Critical Impact
Local actors interacting with Open vSwitch conntrack flows can trigger a kernel use-after-free, enabling denial of service or potential privilege escalation [CWE-416].

Affected Products

Linux kernel (upstream) — Open vSwitch connection tracking subsystem
Distributions shipping affected kernel versions with CONFIG_OPENVSWITCH and netfilter conntrack helpers enabled
Stable kernel branches referenced by the fix commits 18866dc1, 1a4151e6, 5f23080a, afcf3626, and e02a83bb

Discovery Timeline

2026-10-18 - CVE-2026-98490 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98490

Vulnerability Analysis

The vulnerability affects the net/openvswitch/conntrack.c path that invokes netfilter conntrack helpers on unconfirmed connections. During helper execution, the kernel inserts an expectation node whose exp structure embeds a raw pointer tied to the current extension allocation of the conntrack entry. If downstream code adds further extensions, for example NAT, labels, or mark extensions, the extension memory block can be reallocated through nf_ct_ext_add(). The reallocation invalidates the pointer already linked into master_help->expectations. When the kernel later walks the expectation list to remove the entry, it accesses freed memory.

Root Cause

The root cause is an ordering bug combined with a lifetime assumption violation. The conntrack code assumed that extension pointers captured during helper invocation would remain valid for the duration of the expectation. In reality, nf_ct_ext_add() may krealloc() the extension block, breaking that assumption. The upstream fix reorders the pipeline so that helpers execute only after all other extensions have been added, ensuring the extension layout is stable before any pointer is wired into the expectations list.

Attack Vector

Exploitation requires local access or control over network namespace operations capable of driving Open vSwitch flows that activate conntrack helpers such as FTP, SIP, or TFTP. By crafting traffic or flow table rules that cause helper insertion before additional extensions are appended, an actor can force the stale pointer condition. The resulting use-after-free occurs in kernel context, which can be leveraged for denial of service through a kernel oops or, with additional primitives, memory corruption in a security-sensitive subsystem.

No public proof-of-concept has been published. The vulnerability mechanism is described in the upstream commit messages referenced in Kernel Commit 18866dc1 and Kernel Commit e02a83bb.

Detection Methods for CVE-2026-98490

Indicators of Compromise

Kernel oops or BUG: KASAN: use-after-free messages referencing nf_ct_expect, nf_ct_helper, or ovs_ct_execute in dmesg output.
Unexpected kernel panics on hosts running Open vSwitch with conntrack helpers for protocols such as FTP, SIP, H.323, or TFTP.
Repeated conntrack expectation churn in /proc/net/nf_conntrack_expect correlated with host instability.

Detection Strategies

Enable KASAN on test kernels to surface the use-after-free deterministically during fuzzing of OVS flow tables with helper-bound protocols.
Monitor kernel ring buffer logs for stack traces touching nf_ct_expect_insert, nf_ct_remove_expectations, and __nf_ct_ext_add.
Baseline running kernel versions across the fleet and flag hosts behind the patched stable commits listed in the NVD advisory.

Monitoring Recommendations

Centralize journalctl -k and /var/log/kern.log output into a SIEM to correlate kernel faults with workload activity.
Alert on repeated Open vSwitch datapath restarts or ovs-vswitchd crashes that coincide with conntrack-related stack traces.
Track container and virtualization hosts that rely on OVS for east-west traffic, since these environments concentrate exposure.

How to Mitigate CVE-2026-98490

Immediate Actions Required

Inventory all Linux hosts running Open vSwitch with conntrack enabled and identify kernels predating the fix commits referenced in the NVD entry.
Apply vendor kernel updates that include the patch set, prioritizing hypervisors, Kubernetes nodes, and network function virtualization hosts.
Restrict local and container workloads from arbitrarily loading or configuring conntrack helper modules until patches are deployed.

Patch Information

The fix moves helper invocation to run after all other conntrack extensions are added, preventing the stale extension pointer from being linked into the expectations list. The upstream commits are available at Kernel Commit 18866dc1, Kernel Commit 1a4151e6, Kernel Commit 5f23080a, Kernel Commit afcf3626, and Kernel Commit e02a83bb. Consume the fix through your distribution's stable kernel channel.

Workarounds

Disable automatic loading of conntrack helper modules by setting net.netfilter.nf_conntrack_helper=0 where protocol helpers are not required.
Remove or avoid OVS flow rules that invoke ct(helper=...) actions for FTP, SIP, TFTP, or H.323 traffic until the kernel is patched.
Blacklist helper modules such as nf_conntrack_ftp, nf_conntrack_sip, and nf_conntrack_tftp in /etc/modprobe.d/ on hosts that do not require them.

bash

# Configuration example: disable automatic conntrack helper assignment
sysctl -w net.netfilter.nf_conntrack_helper=0
echo 'net.netfilter.nf_conntrack_helper=0' > /etc/sysctl.d/99-cve-2026-98490.conf

# Prevent affected helper modules from loading at boot
cat > /etc/modprobe.d/disable-ct-helpers.conf <<'EOF'
install nf_conntrack_ftp /bin/true
install nf_conntrack_sip /bin/true
install nf_conntrack_tftp /bin/true
EOF