CVE-2026-98442
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
net/sched: act_ct: corregir UAF en el helper debido a la reasignación de extensiones
Mientras se invocan los helpers, un puntero en bruto al área de extensiones se incorpora a la lista de expectativas:
Si la conexión aún no está confirmada, se pueden añadir más extensiones posteriormente mediante llamadas *_ext_add() que reasignan el espacio de extensiones y dejan el puntero, ya inválido, en la lista de expectativas, a la que se accede más tarde al eliminar la expectativa.
Asegúrese de que los helpers se invoquen al final, una vez añadidas todas las demás extensiones.
Leer descripción completaMostrar menos
Tenga en cuenta que el rechazo del helper deja ahora establecidos la marca y las etiquetas, pero esto no es distinto de cómo se gestionaba antes la NAT ni de cómo se gestionaban la marca y las etiquetas en caso de fallo en la confirmación. Además, la API no ofrece en cualquier caso garantías de atomicidad.
Detalles técnicos trazas, registros y código del informe original
-> nf_ct_helper()
-> helper->help()
-> nf_ct_expect_related_report()
-> nf_ct_expect_insert()
-> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 21/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 5 referencias
- https://git.kernel.org/stable/c/1679bbf5fbeac52a310b1a58b2b301bbf388bdbf
- https://git.kernel.org/stable/c/31f5fe29a572037ee19c233dfe506849940c484b
- https://git.kernel.org/stable/c/812c16a255e7773a544e88b39ae6daed25544d30
- https://git.kernel.org/stable/c/8988f4d11f3fba0ab38122178836c683ad516a05
- https://git.kernel.org/stable/c/dad19b59da050cb60d3f7023dac2a042a84bf0bd
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98442",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "a21b06e7319129994f339ed47f512bbe57b77f5b",
"lessThan": "31f5fe29a572037ee19c233dfe506849940c484b",
"versionType": "git"
},
{
"status": "affected",
"version": "a21b06e7319129994f339ed47f512bbe57b77f5b",
"lessThan": "1679bbf5fbeac52a310b1a58b2b301bbf388bdbf",
"versionType": "git"
},
{
"status": "affected",
"version": "a21b06e7319129994f339ed47f512bbe57b77f5b",
"lessThan": "812c16a255e7773a544e88b39ae6daed25544d30",
"versionType": "git"
},
{
"status": "affected",
"version": "a21b06e7319129994f339ed47f512bbe57b77f5b",
"lessThan": "8988f4d11f3fba0ab38122178836c683ad516a05",
"versionType": "git"
},
{
"status": "affected",
"version": "a21b06e7319129994f339ed47f512bbe57b77f5b",
"lessThan": "dad19b59da050cb60d3f7023dac2a042a84bf0bd",
"versionType": "git"
}
],
"programFiles": [
"net/sched/act_ct.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.2"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.2",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.112",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.55",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.9",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/sched/act_ct.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:16:54.503",
"references": [
{
"url": "https://git.kernel.org/stable/c/1679bbf5fbeac52a310b1a58b2b301bbf388bdbf",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/31f5fe29a572037ee19c233dfe506849940c484b",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/812c16a255e7773a544e88b39ae6daed25544d30",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/8988f4d11f3fba0ab38122178836c683ad516a05",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/dad19b59da050cb60d3f7023dac2a042a84bf0bd",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: fix helper UAF due to extensions realloc\n\nWhile calling the helpers, a raw pointer to the extensions area is\nwired into expectations list:\n\n -> nf_ct_helper()\n -> helper->help()\n -> nf_ct_expect_related_report()\n -> nf_ct_expect_insert()\n -> hlist_add_head_rcu(&exp->lnode, &master_help->expectations)\n\nIn case the connection is not confirmed yet, more extensions can be\nadded afterwards with *_ext_add() calls reallocating the extension\nspace and leaving the now invalid pointer in the expectations list\nthat is later accessed while removing the expectation.\n\nMake sure that helpers are called at the end after all the other\nextensions are already added.\n\nNote that the helper rejection now leaves the mark and labels set,\nbut that's not different from how the NAT was handled before or how\nthe mark and the labels were handled on confirmation failure. And\nthere are no atomicity guarantees provided by the API anyway."
}
],
"lastModified": "2026-10-21T13:21:29.347",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}