CVE-2026-31665

What it actually does

CVE-2026-31665 is a Linux kernel use-after-free in the netfilter/nftables connection-tracking timeout object lifecycle. The vulnerable path frees an nftables connection-tracking timeout object immediately after removing it, while concurrent packet-processing code on another CPU may still access the same object through an RCU-protected reference. This race can lead to stale kernel memory access in connection-tracking code, potentially causing kernel memory corruption, denial of service through a kernel crash, information disclosure, or local privilege escalation if the memory corruption is successfully controlled.

Why it matters to the business

Systems running affected Linux kernels may be exposed to local privilege escalation or host instability from users or processes that can exercise nftables/netfilter functionality. The main operational risk is compromise of the underlying host from a lower-privileged local context, including containers or sandboxed workloads where network administration capabilities or user namespace behavior expose nftables operations. Although EPSS is currently low and the vulnerability is not listed in CISA KEV, successful exploitation would affect confidentiality, integrity, and availability of the host kernel, making prompt kernel updates important for multi-user, container-hosting, and internet-facing infrastructure that permits local code execution.

How an attack unfolds

An attacker first obtains local execution on a vulnerable Linux system with enough privilege to interact with nftables/netfilter objects, commonly through CAP_NET_ADMIN or a namespace configuration that allows nftables manipulation. The attacker creates a connection-tracking timeout object, drives traffic through connection tracking so packet-processing code can reference that object, and then concurrently deletes or destroys the object while another CPU still holds an RCU-protected reference. Because the vulnerable kernel frees the object immediately instead of deferring the free until an RCU grace period has elapsed, packet-processing code may dereference freed memory. A simple exploit may crash the kernel; a more advanced exploit may attempt heap shaping and object replacement to turn the use-after-free into controlled kernel memory corruption and privilege escalation.

How to fix it

Upgrade to a Linux kernel build that includes the upstream fix for the nft_ct timeout object destroy path, which changes the timeout object free operation to use RCU-delayed freeing with kfree_rcu(). Because no exact fixed package versions were provided, use the latest security kernel from the operating system or appliance vendor and confirm that the vendor advisory includes the fix for this issue. Reboot into the updated kernel after installation; merely installing the package is not sufficient. As interim mitigation, restrict local access, minimize granting CAP_NET_ADMIN, disable or tightly control unprivileged user namespaces where operationally feasible, limit container capabilities, and restrict nftables administration to trusted privileged users only. Avoid allowing untrusted workloads to manipulate nftables or netfilter objects on shared hosts.

How to confirm the fix worked

Confirm the running kernel version is the patched vendor kernel, not only that an updated package is installed. Validate with commands such as `uname -r` and the distribution package manager, then compare against the vendor security advisory for this vulnerability. Where source or build metadata is available, confirm the kernel contains the netfilter fix that adds RCU-delayed freeing for `struct nf_ct_timeout` and uses `kfree_rcu()` in the nft_ct timeout object destroy path. Review whether untrusted users, containers, or services have CAP_NET_ADMIN or access to user/network namespace configurations that can reach nftables. In test environments, regression validation should include creating and deleting nftables conntrack timeout objects while generating concurrent conntrack traffic and confirming no kernel oops, KASAN use-after-free, panic, or conntrack instability occurs.

Typical attack path

1. Gain local code execution on a vulnerable Linux host.
2. Obtain or abuse permission to interact with nftables/netfilter, such as CAP_NET_ADMIN or permissive user/network namespace configuration.
3. Create nftables connection-tracking timeout objects through nf_tables/netlink interfaces.
4. Generate network traffic that causes conntrack packet-processing code to reference the timeout object.
5. Race deletion/destruction of the timeout object against concurrent packet processing on another CPU.
6. Trigger use-after-free in the kernel conntrack path.
7. Use the resulting memory corruption to crash the system or attempt local privilege escalation.

How to detect it

Detecting prior exploitation is difficult because successful kernel memory-corruption exploitation may leave few durable artifacts. Focus on kernel logs, crash dumps, audit logs, process execution telemetry, container runtime logs, and nftables/netlink administration events. Search for kernel oops, panic, KASAN, slab use-after-free, general protection fault, or BUG messages involving conntrack and nftables functions. Review auditd or EDR telemetry for execution of `nft`, unusual netlink/nf_tables activity, rapid create/delete cycles of nftables objects, or local processes repeatedly manipulating connection-tracking timeout objects. On container hosts, review privileged container launches, CAP_NET_ADMIN grants, host networking use, and namespace creation around the time of any kernel crash. If crash dumps are available, inspect stack traces for `nf_conntrack_tcp_packet`, `nf_conntrack_in`, `nf_hook_slow`, `nft_ct_timeout_obj_init`, `nf_tables_newobj`, `nft_obj_destroy`, and `nf_tables_trans_destroy_work`. Absence of these artifacts does not prove absence of exploitation, especially if the attacker achieved privilege escalation without causing a visible crash.

• BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet
• slab-use-after-free in nf_conntrack_tcp_packet
• nf_conntrack_tcp_packet+
• nf_conntrack_in+
• nf_hook_slow+
• __ip_local_out+
• tcp_sendmsg_locked+
• __sys_sendto+
• nft_ct_timeout_obj_init+
• nf_tables_newobj+
• nfnetlink_rcv_batch+
• nft_obj_destroy+
• nf_tables_trans_destroy_work+
• process_one_work+
• general protection fault
• kernel BUG at
• Kernel panic - not syncing
• nft add ct timeout
• nft delete ct timeout
• nft destroy ct timeout
• CAP_NET_ADMIN

What your security team should do

• Prioritize patching shared Linux hosts, container hosts, CI runners, bastion systems, and multi-user systems where local users or workloads may have network administration capabilities.
• Reboot systems after applying the fixed kernel and verify the running kernel version matches the patched version.
• Inventory workloads and containers granted CAP_NET_ADMIN, privileged container mode, or broad namespace permissions; remove these permissions where not strictly required.
• Disable or restrict unprivileged user namespaces if they are not required, especially on systems that allow untrusted local code execution.
• Monitor kernel logs for netfilter, conntrack, nftables, KASAN, general protection fault, and kernel oops messages that may indicate attempted triggering.
• Treat unexplained kernel crashes involving `nf_conntrack_tcp_packet`, `nf_conntrack_in`, `nft_ct_timeout_obj_init`, or `nft_obj_destroy` as potentially security-relevant.
• If exploitation is suspected, preserve volatile evidence quickly, including kernel logs, audit logs, recent nftables changes, process history, container metadata, and crash dumps before rebooting where feasible.