CVE-2026-31414: netfilter: nf_conntrack_expect: use expect->helper
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrackexpect: use expect->helper
Use expect->helper in ctnetlink and /proc to dump the helper name. Using nfcthelp() without holding a reference to the master conntrack is unsafe.
Use exp->master->helper in ctnetlink path if userspace does not provide an explicit helper when creating an expectation to retain the existing behaviour. The ctnetlink expectation path holds the reference on the master conntrack and nfconntrackexpect lock and the nfnetlink glue path refers to the master ct that is attached to the skb.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31414?
The severity of CVE-2026-31414 is considered medium due to potential disruption in network packet processing.
How do I fix CVE-2026-31414?
To fix CVE-2026-31414, update your Linux kernel to the latest stable version that has addressed this vulnerability.
What is the impact of CVE-2026-31414?
The impact of CVE-2026-31414 may include improper handling of connection tracking helpers in the Linux kernel.
Which systems are affected by CVE-2026-31414?
CVE-2026-31414 affects all versions of the Linux kernel that utilize the netfilter connection tracking module.
Is CVE-2026-31414 exploitative in nature?
CVE-2026-31414 could potentially be exploited to cause instability in connection tracking functionalities if not mitigated.