In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a… (CVE-2026-98491)

The vulnerability (CVE-2026-98491) in the Linux kernel's Open vSwitch conntrack subsystem involves a use-after-free condition triggered when skb packets with unconfirmed connection tracking (ct) entries are cloned and committed with differing extension sets. The first clone commits and wires extension pointers into the expectation list but loses confirmation, keeping the entry unconfirmed. The second clone commits labels and adds new extensions, breaking the pointer in the expectation list and causing a UAF on destruction. The fix resets the ct entry during commit if a shared unconfirmed entry is detected, preventing modification conflicts. This fix addresses the main UAF trigger related to helper introduction.

The vulnerability can cause a use-after-free condition in the kernel's networking stack, potentially leading to memory corruption or kernel crashes. However, the description notes that no practical network pipeline is known to require committing both clones without modifications in the same zone, suggesting limited real-world exploitation scenarios. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to reset the unconfirmed connection tracking entry during commit to avoid sharing and modification issues. Users should apply the official kernel updates that include this fix once available. Since this is a kernel-level vulnerability, upgrading to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory for current remediation guidance.