CVE-2026-98491

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

In a case where skb with an unconfirmed ct entry gets cloned, we may

end up committing both but with different sets of extensions.

The series of events:

1. The first clone wants to commit and runs the helpers wiring up

the extension pointer into the expectation list.

2. Then it looses the confirmation keeping the entry unconfirmed.

3. Second clone now wants to commit labels and adds the new extension

for that breaking the pointer in the expectation list causing

UAF on the destruction path later.

While this is possible to trigger, there should be no practical

network pipeline where committing both clones without modifications

into the same zone is needed. So, let's just reset the entry in case

for some reason we got an skb with a shared one during commit. This

doesn't affect any known use cases, but avoids any potential proble

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References