{"id":"CVE-2026-98490","published":"2026-10-18T16:16:59Z","modified":"2026-10-30T13:21:14Z","title":"In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to…","vendor":"Linux","product":"Linux","tier":"core","eol":null,"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n  -> nf_ct_helper()\n   -> helper->help()\n    -> nf_ct_expect_related_report()\n     -> nf_ct_expect_insert()\n      -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure.  And\nthere are no atomicity guarantees provided by the API anyway.","provenance":"source","from":"NVD"},"summary":{"text":"A use-after-free flaw in the Linux kernel's openvswitch connection tracking code (net/openvswitch conntrack) arises because helpers are invoked before all extensions are added, so a raw pointer to the extension area can be left dangling in the expectations list after the area is reallocated. An attacker with network access and no privileges or user interaction can trigger this by sending traffic that causes helper processing on an unconfirmed connection while further extensions are added, leading to memory corruption when the stale expectation is later accessed.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:24:19Z"},"cvss":{"score":9.8,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00618,"percentile":0.49573,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"Known_Cve | Oct 27, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adf68beabc3bad24a2b7cc6","created":"2026-10-26"},{"name":"Known_Cve | Oct 24, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6adb7414397c3ad4799aa4ce","created":"2026-10-23"},{"name":"Known_Cve | Oct 23, 2026 | Part 2/3","url":"https://otx.alienvault.com/pulse/6ada237de8198eb6a6cbfac4","created":"2026-10-22"},{"name":"Known_Cve | Oct 22, 2026 | Part 3/4","url":"https://otx.alienvault.com/pulse/6ad8d34cb141a6cceeba88be","created":"2026-10-21"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://git.kernel.org/stable/c/18866dc1f525f9ee4de7709529d1ae1af8d8e8be","tags":[]},{"url":"https://git.kernel.org/stable/c/1a4151e6be57b098b7a5ebfbde58585e83200cdc","tags":[]},{"url":"https://git.kernel.org/stable/c/5f23080a625dd7855ab91485c8d691a54a1979f0","tags":[]},{"url":"https://git.kernel.org/stable/c/84d47a83b7b717576de0defab46b8823a22853b0","tags":[]},{"url":"https://git.kernel.org/stable/c/9f308197395c1a524b736e401cbc8a2ed7d246c9","tags":[]},{"url":"https://git.kernel.org/stable/c/afcf362625190c5260530b1d6c7daa98831f6b83","tags":[]},{"url":"https://git.kernel.org/stable/c/e02a83bb0b7a203f6a22f55ad5f426765560f811","tags":[]},{"url":"https://git.kernel.org/stable/c/f53d13a286fb275bda0efdf445b8a1e4dfcb717b","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-103730","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-103730","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-18","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98490","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":18.4,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":9.91,"detail":"percentile 0.4957"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":6.86,"detail":"base score 9.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}