CVE-2026-98441

A flaw was found in the Linux kernel's traffic control conntrack action module (act_ct). An attacker capable of sending network traffic through affected packet filters could trigger a Denial of Service (DoS) or kernel memory corruption. This issue arises when cloned network packets sharing an unconfirmed connection tracking entry are modified, corrupting extension pointers during packet processing. This improper handling results in a use-after-free (UAF) condition upon cleanup, causing the operating system to crash.

This flaw is rated as Moderate severity rather than Important because exploitation requires a specialized traffic control configuration utilizing cloned packets alongside connection tracking actions, constraining the blast radius primarily to a denial of service. The affected traffic control conntrack action is not active in default Red Hat Enterprise Linux networking deployments. Exploiting this issue requires local administrative privileges to establish the requisite packet scheduling rules or a highly specific network pipeline capable of inducing the race condition.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.