CVE-2026-98490High· 7.5▾ TwilightA flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations lis…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 20.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 9.8
none → critical
0.2% → 0.6%
9.8 → 7.5
critical → high
A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations list. An attacker can exploit this issue by sending specially crafted network packets to trigger a use-after-free condition, leading to a Denial of Service (DoS) through a kernel crash or potentially arbitrary code execution.
kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc — rated Important by Red Hat. Released 2026-10-18, updated 2026-10-24.
Affected:
No fix planned:
Not affected:
Affected
Workarounds / mitigations:
The highest-value action is to defer conntrack helper invocation in Open vSwitch until after all connection track…
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-72476Medium· 5.5kernel: dmaengine: Fix possible use after free (CVE-2026-72476)
CVE-2026-74264Medium· 4.7kernel: net: watchdog: fix refcount tracking races (CVE-2026-74264)
CVE-2026-109729Medium· 5.4Use-after-free in the JavaScript Engine: JIT component
CVE-2026-64564Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: sctp: don't free the ASCONF's own transport in DEL-IP processing sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport …
CVE-2026-53384High· 7.0In the Linux kernel, the following vulnerability has been resolved: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails dw8250_probe() registers the 8250 port via serial8250_register_8250_port() and then, if the devi…
CVE-2026-64554High· 7.0kernel: netfilter: bridge: fix stale prevhdr pointer in br_ip6_fragment() (CVE-2026-64554)