CVE-2026-31665

netfilter: nft_ct: fix use-after-free in timeout object destroy

State: Published
Severity: 7.8 High
Published: Apr 24, 2026
Updated: Oct 19, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: fix use-after-free in timeout object destroy

nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data().

Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c.

KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80

Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320

Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00

Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	7e0b2b57f01d183e1c84114f1f2287737358d748 to before c458fc1c278a65ad5381083121d39a479973ebedAffected 7e0b2b57f01d183e1c84114f1f2287737358d748 to before c581e5c8f2b59158f62efe61c1a3dc36189081ffAffected 7e0b2b57f01d183e1c84114f1f2287737358d748 to before f16fe84879a5280f05ebbcea593a189ba0f3e79aAffected 7e0b2b57f01d183e1c84114f1f2287737358d748 to before 070abdf1b04325b21a20a2a0c39a2208af107275Affected 7e0b2b57f01d183e1c84114f1f2287737358d748 to before aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77Affected 7e0b2b57f01d183e1c84114f1f2287737358d748 to before b42aca3660dc2627a29a38131597ca610dc451f9Affected 7e0b2b57f01d183e1c84114f1f2287737358d748 to before d0983b48c10d1509fd795c155f8b1e832e1369ffAffected 7e0b2b57f01d183e1c84114f1f2287737358d748 to before f8dca15a1b190787bbd03285304b569631160edaAffected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.253 through 5.10.Not affected 5.15.203 through 5.15.Not affected 6.1.169 through 6.1.Not affected 6.6.135 through 6.6.Not affected 6.12.82 through 6.12.Not affected 6.18.23 through 6.18.Not affected 6.19.13 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

7e0b2b57f01d183e1c84114f1f2287737358d748 to before c458fc1c278a65ad5381083121d39a479973ebedAffected
7e0b2b57f01d183e1c84114f1f2287737358d748 to before c581e5c8f2b59158f62efe61c1a3dc36189081ffAffected
7e0b2b57f01d183e1c84114f1f2287737358d748 to before f16fe84879a5280f05ebbcea593a189ba0f3e79aAffected
7e0b2b57f01d183e1c84114f1f2287737358d748 to before 070abdf1b04325b21a20a2a0c39a2208af107275Affected
7e0b2b57f01d183e1c84114f1f2287737358d748 to before aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77Affected
7e0b2b57f01d183e1c84114f1f2287737358d748 to before b42aca3660dc2627a29a38131597ca610dc451f9Affected
7e0b2b57f01d183e1c84114f1f2287737358d748 to before d0983b48c10d1509fd795c155f8b1e832e1369ffAffected
7e0b2b57f01d183e1c84114f1f2287737358d748 to before f8dca15a1b190787bbd03285304b569631160edaAffected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.253 through 5.10.*Not affected
5.15.203 through 5.15.*Not affected
6.1.169 through 6.1.*Not affected
6.6.135 through 6.6.*Not affected
6.12.82 through 6.12.*Not affected
6.18.23 through 6.18.*Not affected
6.19.13 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.