CVE-2026-31665

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_ct: fix use-after-free in timeout object destroy

nft_ct_timeout_obj_destroy() frees the timeout object with kfree()

immediately after nf_ct_untimeout(), without waiting for an RCU grace

period. Concurrent packet processing on other CPUs may still hold

RCU-protected references to the timeout object obtained via

rcu_dereference() in nf_ct_timeout_data().

Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer

freeing until after an RCU grace period, matching the approach already

used in nfnetlink_cttimeout.c.

KASAN report:

BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0

Read of size 4 at addr ffff8881035fe19c by task exploit/80

Call Trace:

nf_conntrack_tcp_packet+0x1381/0x29d0

nf_conntrack_in+0x612/0x8b0

nf_hook_slow+0x70/0x100

__ip_local_out+0x1b2/0x210

tcp_sendmsg_locked+0x722/0x1580

__sys_sendto+0x2d8/0x320

Allocated by task 75:

nft_ct_timeou

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References