In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While… (CVE-2026-98490)

The vulnerability in the Linux kernel's openvswitch conntrack helper arises from a use-after-free condition caused by reallocating the extensions area after a raw pointer to it has been stored in the expectations list. Specifically, when connections are not yet confirmed, additional extensions can be added, causing the extension space to be reallocated and invalidating the pointer stored in the expectations list. This invalid pointer is later accessed during expectation removal, leading to a use-after-free scenario. The fix involves deferring helper calls until after all extensions have been added, preventing the invalid pointer usage. The helper rejection behavior leaves marks and labels set, consistent with previous handling, and the API does not guarantee atomicity.

The use-after-free vulnerability could lead to kernel memory corruption or instability when the invalid pointer is accessed. This may result in denial of service or potentially other undefined behavior within the kernel networking subsystem. No confirmed exploits are known in the wild. The impact is limited to affected Linux kernel openvswitch conntrack helper functionality.

A fix has been implemented in the Linux kernel to ensure that helpers are called only after all extensions are added, preventing the use-after-free condition. Users should apply the official kernel updates that include this fix. No additional mitigation steps are indicated or required beyond applying the patch.