CVE-2026-98873

What it actually does

The vulnerability permits leakage of uninitialized kernel memory to userspace via the ctnetlink interface when nf_conntrack_expect structures are allocated without zeroing.

Why it matters to the business

Minimal operational risk of inadvertent exposure of internal kernel data through network connection tracking queries; the issue affects a rarely used feature, carries low exploitation probability, and has no known active campaigns or ransomware usage two days after publication.

How an attack unfolds

An attacker with sufficient privileges to interact with the netfilter ctnetlink socket triggers allocation of a connection tracking expectation, then issues netlink queries that return the structure contents, allowing extraction of whatever uninitialized data remained in memory.

How to fix it

Apply the upstream kernel commit that zeros the nf_conntrack_expect structure at allocation time; rebuild and deploy updated kernels across affected systems.

How to confirm the fix worked

Inspect kernel source for the allocation-site memset or kzalloc change in nf_conntrack_expect; confirm the fix by reviewing the netfilter conntrack expectation initialization path.

Typical attack path

1. Obtain access to the ctnetlink netlink socket
2. Force allocation of an nf_conntrack_expect object
3. Issue ctnetlink dump or get operations on expectations
4. Parse returned data for uninitialized kernel memory contents

How to detect it

Monitor kernel audit logs and netlink activity for unexpected ctnetlink queries targeting connection tracking expectations; examine system call traces involving netfilter for anomalous expectation handling.

What your security team should do

• Prioritize kernel updates during the next maintenance window given the two-day publication age and stable low EPSS
• Review any custom or legacy use of connection tracking expectations in netfilter rulesets
• Disable ctnetlink access for untrusted users where feasible