CVE-2026-31496: netfilter: nf_conntrack_expect: skip expectations in other netns via proc
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfconntrackexpect: skip expectations in other netns via proc
Skip expectations that do not reside in this netns.
Similar to e77e6ff502ea ("netfilter: conntrack: do not dump other netns's conntrack entries via proc").
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch e77e6ff502ea - Configuration
Implement the kernel fix so that nf_conntrack_expect skips expectations that do not reside in the current netns when handling conntrack expectation dumping via proc.
Linux kernel netfilter (nf_conntrack_expect via proc) Skip expectations not residing in this netns when dumping conntrack expectations via /proc = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31496?
CVE-2026-31496 has a medium severity rating due to the potential for unauthorized access to networking expectations in different network namespaces.
How do I fix CVE-2026-31496?
To fix CVE-2026-31496, update the Linux kernel to the latest version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2026-31496?
CVE-2026-31496 affects multiple versions of the Linux kernel, ranging from 2.6.28 to 7.0-rc7.
What impact does CVE-2026-31496 have on my Linux system?
CVE-2026-31496 may allow attackers to manipulate networking expectations in other network namespaces, potentially leading to security breaches.
Is CVE-2026-31496 a remote vulnerability?
CVE-2026-31496 can be exploited remotely if the system is improperly configured or if network namespace isolation is not appropriately implemented.