CVE-2026-98491: Linux Kernel Use-After-Free Vulnerability

CVE-2026-98491 Overview

CVE-2026-98491 is a use-after-free vulnerability in the Linux kernel's Open vSwitch (OVS) connection tracking (conntrack) subsystem. The flaw occurs when a socket buffer (skb) carrying an unconfirmed conntrack entry is cloned, and both clones attempt to commit the entry with different sets of extensions. The first clone wires an extension pointer into the expectation list but loses the confirmation race. A second clone then commits labels and adds a new extension, breaking the pointer in the expectation list. The result is a use-after-free (UAF) on the destruction path.

Critical Impact
A use-after-free in kernel-mode conntrack handling can lead to kernel memory corruption, denial of service, or local privilege escalation on hosts running Open vSwitch.

Affected Products

Linux kernel builds including the net/openvswitch/conntrack.c subsystem
Hosts and hypervisors running Open vSwitch for virtual networking
Container and cloud platforms (Kubernetes, OpenStack) that rely on OVS datapaths

Discovery Timeline

2026-10-18 - CVE-2026-98491 published to NVD
2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98491

Vulnerability Analysis

The vulnerability lives in the Open vSwitch conntrack commit path. When a packet carries an unconfirmed nf_conn entry and that skb gets cloned, both clones can observe and modify the same shared conntrack entry. The commit path invokes conntrack helpers that register extension pointers into the expectation list.

If the first clone registers helper extensions and then fails confirmation, the entry remains unconfirmed but with live pointers held by the expectation infrastructure. When the second clone subsequently commits and adds a labels extension, the extension area may be reallocated. This reallocation invalidates the pointer previously stored in the expectation list, producing a dangling reference that is dereferenced during conntrack destruction.

Root Cause

The root cause is unsafe sharing of a mutable unconfirmed conntrack entry between cloned socket buffers. Conntrack extension storage can be reallocated when new extensions are added, but the expectation list retains direct pointers into that storage. There is no synchronization or ownership transfer when the skb is cloned, so two code paths can race to mutate shared state.

Attack Vector

Triggering the condition requires a network pipeline that clones an skb with an unconfirmed conntrack entry and then commits both clones into the same conntrack zone with differing extension sets. The upstream fix, referenced in commits such as 26b2bd7 and 457e0df, resets the entry when a shared unconfirmed ct is encountered during commit, preventing the UAF. Review the full commit set for implementation detail; no public exploit is available for this issue.

Detection Methods for CVE-2026-98491

Indicators of Compromise

Kernel oops or general protection fault traces referencing nf_ct_ext, nf_conntrack_destroy, or ovs_ct_commit functions in dmesg or /var/log/kern.log.
KASAN or SLUB debug reports flagging use-after-free in the net/openvswitch/conntrack.c code path.
Unexpected ovs-vswitchd restarts or sudden host reboots on nodes handling heavy conntrack workloads.

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface the UAF deterministically during regression testing of OVS workloads.
Monitor kernel ring buffers for stack traces that include nf_ct_tmpl_free, __nf_ct_ext_add, or Open vSwitch commit symbols.
Correlate host crash telemetry with periods of elevated packet cloning (multicast, mirrored traffic, or recirculation).

Monitoring Recommendations

Centralize kernel logs from OVS hosts and alert on repeated panics or UAF signatures.
Track running kernel versions across the fleet and flag hosts that have not received the fix.
Baseline conntrack table size and churn rates to spot abnormal spikes that may indicate exploitation attempts.

How to Mitigate CVE-2026-98491

Immediate Actions Required

Inventory Linux hosts running Open vSwitch with conntrack-based flow rules and prioritize patching.
Apply the stable kernel update that includes the Open vSwitch conntrack fix from the upstream commit series.
Restrict local, unprivileged access to hosts running OVS, since the trigger path requires network state manipulation on the host datapath.

Patch Information

The fix was merged across multiple stable kernel branches. Refer to the upstream commits for the authoritative patch: 26b2bd7, 37e3c87, 457e0df, 55e5256, 707c2dc, de41ee2, e0fa5ea, and e2829ae5. Deploy vendor-provided kernel updates from your Linux distribution as they become available.

Workarounds

Avoid OVS flow configurations that commit the same unconfirmed conntrack entry from cloned packets into the same zone with differing extensions.
Where feasible, offload conntrack-sensitive processing to pipelines that do not rely on skb cloning in the datapath.
Harden host access controls to prevent untrusted local users from influencing OVS flow tables.

bash

# Verify running kernel version against the patched build
uname -r

# Confirm Open vSwitch is in use and inspect loaded conntrack modules
lsmod | grep -E 'openvswitch|nf_conntrack'

# Enable persistent kernel log capture for crash forensics
journalctl -k -b -p err