CVE-2026-98442

A flaw was found in the Linux kernel's traffic control connection tracking action (act_ct). An attacker capable of sending network traffic handled by the affected system can cause a Denial of Service (DoS) or kernel memory corruption through a use-after-free vulnerability. This issue occurs because connection tracking helpers record pointers to extension memory before all extensions are added, leaving invalid references when memory is subsequently reallocated.

This vulnerability is rated as an Important severity flaw because it can be triggered remotely without privileges, potentially causing kernel memory corruption or an immediate denial of service on impacted hosts. The risk is constrained to environments actively utilizing traffic control connection tracking actions alongside protocol helpers, which is not a default configuration on Red Hat Enterprise Linux. Systems running standard networking configurations without these specialized packet filters are not exposed.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

--- CME Mitigation Guidance (2026-10-20) --- Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.

The highest-value action is to ensure conntrack helper functions run only after all connection tracking extensions have been finalized in traffic control act_ct processing: upgrade to the fixed Kernel/Kernel Ivos Qualcomm/Kernel Rt/Openshift/Ose Rhel Coreos/Kpatch builds, which reorder act_ct operations to invoke conntrack helpers after all connection extensions are allocated and added, closing all 2 injection vectors (crafted network packets processed by act_ct, unconfirmed connection tracking extension reallocation). Until patched, this is a concern on Linux systems running traffic control with connection tracking action act_ct and conntrack helpers enabled, so audit and restrict traffic control act_ct rules that assign connection tracking helpers to untrusted or unconfirmed network traffic flows. As a compensating measure, enable runtime memory error detection such as KASAN or HWASan to trap use-after-free and invalid pointer accesses when conntrack extension memory is dereferenced. These controls limit blast radius and contain exploitation, but they do not fix the underlying use-after-free vulnerability — apply the upstream patch to fully remediate.

Highest-impact CME: CME-1005 Runtime Memory Error Detection (KASAN/HWASan) (medium)