CVE-2026-31496

What it actually does

CVE-2026-31496 is a Linux kernel netfilter connection-tracking flaw in the nf_conntrack_expect procfs interface. The vulnerable code may iterate or expose connection-tracking expectation entries that belong to a different network namespace instead of restricting output to the caller’s namespace. Because this occurs in kernel-space netfilter state handling, a local low-privileged attacker who can access relevant procfs network files may trigger incorrect namespace handling that can degrade availability, including kernel warnings, crashes, or denial of service. The CVSS vector indicates local access, low attack complexity, low privileges required, no user interaction, and high availability impact.

Why it matters to the business

Successful exploitation can disrupt Linux hosts by crashing or destabilizing kernel networking functionality, potentially causing service outages, workload restarts, node failures, or degraded container/network-isolated environments. The issue is not currently listed in CISA KEV, has no known mature public exploit, and has a low EPSS score with no recent upward trend, so broad opportunistic exploitation is not indicated; however, kernel availability flaws can still be material for multi-user systems, container platforms, shared infrastructure, and high-availability services running affected kernels.

How an attack unfolds

An attacker first obtains local low-privileged access to a Linux system, such as through a shell, compromised service account, or contained workload with access to network namespace procfs views. The attacker then interacts with netfilter connection-tracking expectation state, commonly exposed through procfs paths such as /proc/net/nf_conntrack_expect or namespace-specific equivalents. On an affected kernel, the procfs reader may fail to filter expectations by the current network namespace and may process expectation entries from another namespace. By repeatedly reading or manipulating conditions around these entries, the attacker can trigger faulty kernel behavior in the netfilter expectation traversal path, potentially resulting in a kernel oops, networking disruption, or system denial of service.

How to fix it

Upgrade to a Linux kernel version that includes the upstream fix for netfilter nf_conntrack_expect namespace filtering. Because no specific fixed versions were provided in the input, use the fixed kernel builds from the relevant Linux distribution or vendor security advisory and ensure the patch that skips expectations outside the current network namespace is included. Reboot into the patched kernel after installation; merely installing the package is insufficient if the running kernel remains vulnerable. As temporary mitigations, restrict local shell access, limit untrusted workloads from accessing host procfs or host network namespaces, avoid granting unnecessary container privileges such as hostNetwork or broad CAP_NET_ADMIN, disable unneeded netfilter connection-tracking helpers where operationally feasible, and apply standard kernel hardening and workload isolation controls.

How to confirm the fix worked

Confirm the running kernel, not only the installed kernel package, has been updated by checking uname -a and the distribution package version against vendor advisories. Validate that the fix is present by reviewing the kernel changelog or source patch for nf_conntrack_expect namespace filtering behavior that skips expectations not belonging to the current network namespace. After reboot, verify netfilter-related services and workloads operate normally, and confirm that local users or containers do not have unnecessary access to host /proc/net views or host network namespaces. For exposure assessment, inventory Linux systems running kernels published before the vendor-fixed build and prioritize systems that host untrusted users, containers, shared workloads, or network namespace-heavy platforms.

Typical attack path

1. Gain local low-privileged execution on an affected Linux host.
2. Identify whether netfilter connection tracking and expectation support are enabled or loaded.
3. Access procfs network namespace files such as /proc/net/nf_conntrack_expect or /proc/self/net/nf_conntrack_expect.
4. Create or wait for netfilter expectation entries associated with other network namespaces, such as through connection-tracking helpers or network namespace activity.
5. Read the vulnerable procfs interface so the kernel traverses expectation entries that should have been skipped.
6. Repeat or automate the interaction to increase the likelihood of triggering kernel instability or denial of service.

How to detect it

Look for evidence of attempted or successful local denial of service rather than remote network indicators. Useful sources include kernel logs from journald, syslog, dmesg, auditd process execution records, container runtime logs, and endpoint telemetry showing repeated reads of procfs connection-tracking expectation files. Investigate kernel oops, panic, soft lockup, general protection fault, or unexpected reboot events that reference netfilter, conntrack, nf_conntrack_expect, or nf_ct_expect code paths. Correlate those events with local users, processes, containers, or automation repeatedly accessing /proc/net/nf_conntrack_expect or /proc/self/net/nf_conntrack_expect. In container environments, review workloads with host network namespace access, privileged mode, host /proc mounts, or CAP_NET_ADMIN around the time of kernel instability. Because this vulnerability has no reported KEV exploitation and no mature public exploit in the supplied intelligence, absence of known threat-actor infrastructure indicators is expected; focus detection on host telemetry and kernel crash artifacts.

• /proc/net/nf_conntrack_expect
• /proc/self/net/nf_conntrack_expect
• nf_conntrack_expect
• nf_ct_expect
• nf_conntrack
• kernel: BUG: unable to handle kernel
• kernel: general protection fault
• kernel: kernel NULL pointer dereference
• kernel: Oops:
• kernel: Call Trace:
• kernel: panic
• kernel: soft lockup
• kernel: hard LOCKUP
• dmesg: nf_conntrack_expect
• journalctl: nf_conntrack_expect

What your security team should do

• Patch affected Linux kernels through the operating system vendor and reboot into the fixed kernel during the next appropriate maintenance window, prioritizing shared, multi-tenant, container, and internet-facing service hosts.
• Inventory systems with netfilter connection tracking enabled and identify hosts where untrusted local users or workloads can access /proc/net or host network namespaces.
• Review container and workload configurations for excessive privileges, especially hostNetwork, hostPID, hostPath mounts of /proc, privileged mode, and CAP_NET_ADMIN.
• Monitor kernel logs for netfilter, conntrack, oops, panic, or unexpected reboot events until patching is complete.
• Treat exploitation likelihood as currently low because there is no KEV listing, no known mature exploit, and EPSS is low and flat, but do not ignore the issue on high-availability or shared Linux infrastructure.
• Where immediate patching is not possible, reduce local attack surface by removing unnecessary shell access, tightening namespace isolation, and disabling unneeded netfilter helper functionality where compatible with operations.