CVE-2026-98442High· 7.5▾ TwilightA flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption throu…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 7.8
none → high
7.8 → 7.5
A flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption through a use-after-free vulnerability. This issue occurs because connection tracking helpers record pointers to extension memory before all extensions are added, leaving invalid references when memory is subsequently reallocated.
kernel: net/sched: act_ct: fix helper UAF due to extensions realloc — rated Important by Red Hat. Released 2026-10-18, updated 2026-10-24.
Affected:
No fix planned:
Not affected:
Affected
Workarounds / mitigations:
The highest-value action is to ensure conntrack helper functions run only after all connection tracking extension…
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-80764Medium· 4.7kernel: Bluetooth: hci_event: fix LE list UAF on reset (CVE-2026-80764)
CVE-2026-74264Medium· 4.7kernel: net: watchdog: fix refcount tracking races (CVE-2026-74264)
CVE-2026-64554High· 7.0kernel: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (CVE-2026-64554)
CVE-2026-64475High· 7.0kernel: vfio/pci: Release the VGA arbiter client on register_device() failure (CVE-2026-64475)
CVE-2025-68793High· 7.0kernel: Linux kernel: `drm/amdgpu` use-after-free vulnerability leading to denial of service (CVE-2025-68793)
CVE-2026-109729Medium· 5.4Use-after-free in the JavaScript Engine: JIT component