CVE-2026-98491
En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:
net: openvswitch: conntrack: evitar modificar una entrada ct no confirmada compartida
En un caso en el que un skb con una entrada ct no confirmada se clona, podemos acabar confirmando ambos, pero con conjuntos distintos de extensiones.
La secuencia de eventos:
1. El primer clon quiere confirmar y ejecuta los helpers que enlazan el puntero de la extensión en la lista de expectativas. 2. Después pierde la confirmación, con lo que la entrada se queda no confirmada. 3. El segundo clon ahora quiere confirmar etiquetas y añade la nueva extensión para ello, rompiendo el puntero en la lista de expectativas y provocando un UAF (use-after-free (uso de memoria liberada)) más adelante, en la ruta de destrucción.
Leer descripción completaMostrar menos
Aunque es posible provocarlo, no debería existir ninguna cadena de red práctica en la que sea necesario confirmar ambos clones sin modificaciones en la misma zona. Así que, por si por alguna razón se recibe durante la confirmación un skb con una entrada compartida, simplemente restablecemos la entrada. Esto no afecta a ningún caso de uso conocido, pero evita posibles problemas derivados de compartir y modificar la entrada ct no confirmada.
La etiqueta Fixes apunta a la introducción de los helpers, ya que ese es el principal desencadenante del UAF por compartir la entrada.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.21 %
- Percentil entre todas las CVEs puntuadas
- 11
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 8 referencias
- https://git.kernel.org/stable/c/26b2bd70d22457556e2fa01cbf1192cb1a94d619
- https://git.kernel.org/stable/c/37e3c878b183a115f9a114067f9ef3b408ad27fb
- https://git.kernel.org/stable/c/457e0df1b5711fbeb7ba1b6bfd826f5ef30e7e55
- https://git.kernel.org/stable/c/55e5256adf3940e71802e2f749cacf81518726b0
- https://git.kernel.org/stable/c/707c2dc77891a874f4e8c52c285a511079164ec8
- https://git.kernel.org/stable/c/de41ee24f77b0fc45397db3e277cae2adbd43dfe
- https://git.kernel.org/stable/c/e0fa5ea434b7e8467ef3adc64e3858b1ca2a642d
- https://git.kernel.org/stable/c/e2829ae5459ddb5fce526b2e84697edf6c0c3cef
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98491",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "e0fa5ea434b7e8467ef3adc64e3858b1ca2a642d",
"versionType": "git"
},
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "37e3c878b183a115f9a114067f9ef3b408ad27fb",
"versionType": "git"
},
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "707c2dc77891a874f4e8c52c285a511079164ec8",
"versionType": "git"
},
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "de41ee24f77b0fc45397db3e277cae2adbd43dfe",
"versionType": "git"
},
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "55e5256adf3940e71802e2f749cacf81518726b0",
"versionType": "git"
},
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "e2829ae5459ddb5fce526b2e84697edf6c0c3cef",
"versionType": "git"
},
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "457e0df1b5711fbeb7ba1b6bfd826f5ef30e7e55",
"versionType": "git"
},
{
"status": "affected",
"version": "cae3a2627520c3795b54533c5328b77af3405dbe",
"lessThan": "26b2bd70d22457556e2fa01cbf1192cb1a94d619",
"versionType": "git"
}
],
"programFiles": [
"include/net/netfilter/nf_conntrack.h",
"net/openvswitch/conntrack.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.3"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.3",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.271",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.222",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.189",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.158",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/netfilter/nf_conntrack.h",
"net/openvswitch/conntrack.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:00.020",
"references": [
{
"url": "https://git.kernel.org/stable/c/26b2bd70d22457556e2fa01cbf1192cb1a94d619",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/37e3c878b183a115f9a114067f9ef3b408ad27fb",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/457e0df1b5711fbeb7ba1b6bfd826f5ef30e7e55",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/55e5256adf3940e71802e2f749cacf81518726b0",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/707c2dc77891a874f4e8c52c285a511079164ec8",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/de41ee24f77b0fc45397db3e277cae2adbd43dfe",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e0fa5ea434b7e8467ef3adc64e3858b1ca2a642d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/e2829ae5459ddb5fce526b2e84697edf6c0c3cef",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry\n\nIn a case where skb with an unconfirmed ct entry gets cloned, we may\nend up committing both but with different sets of extensions.\n\nThe series of events:\n\n 1. The first clone wants to commit and runs the helpers wiring up\n the extension pointer into the expectation list.\n 2. Then it looses the confirmation keeping the entry unconfirmed.\n 3. Second clone now wants to commit labels and adds the new extension\n for that breaking the pointer in the expectation list causing\n UAF on the destruction path later.\n\nWhile this is possible to trigger, there should be no practical\nnetwork pipeline where committing both clones without modifications\ninto the same zone is needed. So, let's just reset the entry in case\nfor some reason we got an skb with a shared one during commit. This\ndoesn't affect any known use cases, but avoids any potential problems\nwith sharing and modification of the unconfirmed ct entry.\n\nThe fixes tag points to the introduction of helpers, since that's the\nmain UAF trigger for the sharing."
}
],
"lastModified": "2026-10-19T10:19:01.030",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}