CVE-2026-31665: netfilter: nft_ct: fix use-after-free in timeout object destroy
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftct: fix use-after-free in timeout object destroy
nftcttimeoutobjdestroy() frees the timeout object with kfree() immediately after nfctuntimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcudereference() in nfcttimeoutdata().
Add an rcuhead to struct nfcttimeout and use kfreercu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlinkcttimeout.c.
KASAN report: BUG: KASAN: slab-use-after-free in nfconntracktcppacket+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80
Call Trace: nfconntracktcppacket+0x1381/0x29d0 nfconntrackin+0x612/0x8b0 nfhookslow+0x70/0x100 iplocalout+0x1b2/0x210 tcpsendmsglocked+0x722/0x1580 syssendto+0x2d8/0x320
Allocated by task 75: nftcttimeoutobjinit+0xf6/0x290 nftobjinit+0x107/0x1b0 nftablesnewobj+0x680/0x9c0 nfnetlinkrcvbatch+0xc29/0xe00
Freed by task 26: nftobjdestroy+0x3f/0xa0 nftablestransdestroywork+0x51c/0x5c0 processonework+0x2c4/0x5a0
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the kernel netfilter code so that the timeout object is RCU-protected and destroyed by deferring the free via an RCU callback: add an rcu_head to struct nf_ct_timeout, and in nft_ct_timeout_obj_destroy() replace kfree() with kfree_rcu() so that freeing occurs after the RCU grace period. Ensure the destroy path uses the same RCU grace approach already used for the nf_ct_untimeout() path.
Linux kernel netfilter (nft_ct / nf_conntrack timeout destroy path) Use RCU deferred free for timeout object (struct nf_ct_timeout + rcu_head, kfree_rcu()) = Apply the resolved change: add rcu_head to struct nf_ct_timeout and free timeout with kfree_rcu() after an RCU grace period instead of kfree()
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31665?
The severity of CVE-2026-31665 is categorized as high due to the potential for a local user to exploit the use-after-free vulnerability.
How do I fix CVE-2026-31665?
To fix CVE-2026-31665, update the Linux kernel to the latest version that includes the patch addressing this vulnerability.
Which versions of the Linux kernel are affected by CVE-2026-31665?
CVE-2026-31665 affects multiple versions of the Linux kernel prior to the release that includes the fix for the use-after-free vulnerability.
Can CVE-2026-31665 be exploited remotely?
CVE-2026-31665 is not typically exploitable remotely as it requires local access to the system for abuse.
What are the implications of CVE-2026-31665 on system stability?
Exploiting CVE-2026-31665 may lead to system crashes or unpredictable behavior due to the use-after-free condition in the kernel.