Cloudanix VulnDB

CVE-2026-98490

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's network tracking code can let attackers crash servers or run code by sending specially crafted network traffic.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in Linux kernel net/openvswitch conntrack when nf_ct_helper() calls leave raw pointers into the extensions area in the expectations hlist; subsequent *_ext_add() reallocations invalidate those pointers before nf_ct_expect removal accesses them.

Why it matters to the business

Kernel instability or potential arbitrary code execution during network connection tracking in virtual switches, which can disrupt packet forwarding, cause host crashes, and affect any workloads relying on Open vSwitch or conntrack.

How an attack unfolds

An attacker sends crafted traffic that engages conntrack helpers on unconfirmed connections, forcing extension reallocations after the helper has wired stale expectation pointers; later expectation cleanup triggers the UAF.

How to fix it

Apply the upstream fix that moves helper invocation to the end of extension processing; upgrade to a kernel containing the resolution for CVE-2026-98490. Reboot affected hosts after the update.

How to confirm the fix worked

Verify the patched kernel source contains the reordered helper call after all *_ext_add operations; confirm no crash on helper rejection paths and test conntrack expectation insertion under extension growth.

Typical attack path

  1. Send initial packets to create an unconfirmed conntrack entry that activates a helper
  2. Trigger additional extension allocations (e.g., via NAT or mark/label operations) that realloc the extension block
  3. Cause expectation insertion and subsequent removal to dereference the now-invalid pointer
  4. Achieve use-after-free for memory corruption or crash

How to detect it

Search kernel logs for oops/panic traces mentioning nf_ct_expect, nf_ct_helper, or openvswitch extensions; inspect conntrack expectation lists during high-churn connection setups.

What your security team should do

  • Patch Linux kernels on all systems using Open vSwitch or netfilter conntrack within the next maintenance window
  • Monitor for kernel oops or warnings in nf_conntrack and openvswitch modules
  • Limit exposure by disabling unnecessary conntrack helpers where possible until patched

The record

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: -> nf_ct_helper() -> helper->help() -> nf_ct_expect_related_report() -> nf_ct_expect_insert() -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations) In case the connection is not confirmed yet, more extensions can be added afterwards with *_ext_add() calls reallocating the extension space and leaving the now invalid pointer in the expectations list that is later accessed while removing the expectation. Make sure that helpers are called at the end after all the other extensions are already added. Note that the helper rejection now leaves the mark and labels set, but that's not different from how the NAT was handled before or how the mark and the labels were handled on confirmation failure. And there are no atomicity guarantees provided by the API anyway.

Affected packages

Ecosystem Package Introduced Fixed