CVE-2026-52970: netfilter: nft_ct: fix missing expect put in obj eval
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftct: fix missing expect put in obj eval
nftctexpectobjeval() allocates an expectation and may call nfctexpectrelated(), but never drops its local reference.
Add nfctexpectput(exp) before return to balance allocation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.143.1-1 - Compensating control
Add nf_ct_expect_put(exp) before each return in nft_ct_expect_obj_eval() to balance the local reference allocated by nf_ct_expect_related() / expectation allocation, preventing a missing expect put (use-after-free/leak risk).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-52970?
CVE-2026-52970 has a risk rating of 27, indicating a moderate severity level.
How do I fix CVE-2026-52970?
To fix CVE-2026-52970, update to the latest version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-52970?
CVE-2026-52970 affects systems running the affected versions of the Linux kernel with netfilter nft_ct.
What is the exploit mechanism for CVE-2026-52970?
The exploit mechanism involves a failure to release a local reference when allocating an expectation in the netfilter component.
Is CVE-2026-52970 a remote or local vulnerability?
CVE-2026-52970 is generally considered a local vulnerability, as it affects the kernel's handling of network connections.