---
id: CVE-2026-98490
title: >-
  kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc
  (CVE-2026-98490)
summary: >-
  A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection
  tracking helpers process unconfirmed connections, subsequent memory
  reallocations for extensions can leave a dangling pointer in the connection
  expectations lis…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe: CWE-825
vendor: Red Hat
product: Red Hat Enterprise Linux 9
affected:
  - enterprise_linux 10
  - enterprise_linux 7
  - enterprise_linux 8
  - enterprise_linux 9
  - openshift_container_platform 4
published: '2026-10-18'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:22:47+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98490.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98490.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98490'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2554862'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98490'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98490'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98490.mbox
  - url: 'https://git.kernel.org/stable/c/18866dc1f525f9ee4de7709529d1ae1af8d8e8be'
  - url: 'https://git.kernel.org/stable/c/afcf362625190c5260530b1d6c7daa98831f6b83'
  - url: 'https://git.kernel.org/stable/c/5f23080a625dd7855ab91485c8d691a54a1979f0'
  - url: 'https://git.kernel.org/stable/c/e02a83bb0b7a203f6a22f55ad5f426765560f811'
  - url: 'https://git.kernel.org/stable/c/1a4151e6be57b098b7a5ebfbde58585e83200cdc'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
  - score-dispute
epss: 0.00618
epssPercentile: 0.49392
scores:
  vendor: 7.5
  cna: 9.8
ingestedAt: '2026-10-18T15:45:12.294Z'
---

## Overview

A flaw was found in the Linux kernel's Open vSwitch subsystem. When connection tracking helpers process unconfirmed connections, subsequent memory reallocations for extensions can leave a dangling pointer in the connection expectations list. An attacker can exploit this issue by sending specially crafted network packets to trigger a use-after-free condition, leading to a Denial of Service (DoS) through a kernel crash or potentially arbitrary code execution.

## Vendor advisories

- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, … · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98490.json)

**kernel: net: openvswitch: conntrack: fix helper UAF due to extensions realloc** — rated Important by Red Hat. Released 2026-10-18, updated 2026-10-24.

Affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

No fix planned:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

Not affected:

- Red Hat Enterprise Linux 6

## Remediation

Affected

Workarounds / mitigations:

- --- CME Mitigation Guidance (2026-10-20) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to defer conntrack helper invocation in Open vSwitch until after all connection track…