CVE-2026-31407

netfilter: conntrack: add missing netlink policy validations

State: Published
Severity: 7.1 High
Published: Apr 6, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: conntrack: add missing netlink policy validations

Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink.

These attributes are used by the kernel without any validation. Extend the netlink policies accordingly.

Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..]

and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.

Scores

CVSS	Score	Vector	Source
3.1	7.1 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H	Linux

Weaknesses

CWE-125 Out-of-bounds Read

Affected Products

Product	Versions
LinuxLinux	a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before e7b5766693477c52424cc6c79dd30a7a9c7db52cAffected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 78bba9f73942aa7dca47d817d8cec0fb9b443b70Affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before be88a337bf07afb1ee173f1099294d1b7ab3fefeAffected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before c5e918390002edf0cff80a0e7ce1f86f16a9507cAffected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 9174d28f3f15d8c4962f5980c0be167633880443Affected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 67c53c1978cef3c504237275e39c857e2f6af56eAffected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 0fbae1e74493d5a160a70c51aeba035d8266ea7dAffected a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05Affected
LinuxLinux	2.6.27Affected before 2.6.27Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.10 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before e7b5766693477c52424cc6c79dd30a7a9c7db52cAffected
a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 78bba9f73942aa7dca47d817d8cec0fb9b443b70Affected
a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before be88a337bf07afb1ee173f1099294d1b7ab3fefeAffected
a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before c5e918390002edf0cff80a0e7ce1f86f16a9507cAffected
a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 9174d28f3f15d8c4962f5980c0be167633880443Affected
a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 67c53c1978cef3c504237275e39c857e2f6af56eAffected
a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before 0fbae1e74493d5a160a70c51aeba035d8266ea7dAffected
a258860e01b80e8f554a4ab1a6c95e6042eb8b73 to before f900e1d77ee0ef87bfb5ab3fe60f0b3d8ad5ba05Affected

LinuxLinux

2.6.27Affected
before 2.6.27Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.10 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.