CVE-2026-31407: netfilter: conntrack: add missing netlink policy validations

Severity: high (CVSS 7.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-06 · updated 2026-10-19
Weakness: CWE-787

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.

Affected products

Linux kernel: from 2.6.27 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.10; 7.0-rc1, 7.0-rc2, 7.0-rc3, 7.0-rc4 — fixed in 6.12.83, 6.18.24, 6.19.10, 6.6.136

How to fix

Upgrade to a fixed version: Linux kernel 6.12.83, 6.18.24, 6.19.10, 6.6.136. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-31407 or the next vulnerability affects your stack