CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftct: fix missing expect put in obj eval
nftctexpectobjeval() allocates an expectation and may call nfctexpectrelated(), but never drops its local reference.
Add nfctexpectput(exp) before return to balance allocation.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52970?
CVE-2026-52970 has a risk rating of 27, indicating a moderate severity level.
How do I fix CVE-2026-52970?
To fix CVE-2026-52970, update to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-52970?
CVE-2026-52970 affects systems running the affected versions of the Linux kernel with netfilter nft_ct.
What is the exploit mechanism for CVE-2026-52970?
The exploit mechanism involves a failure to release a local reference when allocating an expectation in the netfilter component.
Is CVE-2026-52970 a remote or local vulnerability?
CVE-2026-52970 is generally considered a local vulnerability, as it affects the kernel's handling of network connections.