In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: zero at allocation time There are occasional LLM… (CVE-2026-98873)

The Linux kernel netfilter component had a vulnerability (CVE-2026-98873) where the nf_conntrack_expect structure was not zeroed at allocation time, leading to occasional leakage of uninitialized kernel memory to userspace through the ctnetlink interface. The vulnerability was addressed by zeroing the expectation structure upon allocation, preventing uninitialized data exposure. The fix also preserved the existing initialization behavior to allow potential re-initialization support.

The vulnerability could lead to leakage of uninitialized kernel memory to userspace, potentially exposing sensitive kernel data. However, the affected structure (expectations) is not frequently used, which may limit the exposure. There are no known exploits in the wild. The impact is primarily information disclosure through uninitialized memory leakage.

A fix has been applied to the Linux kernel to zero the nf_conntrack_expect structure at allocation time, preventing uninitialized data leakage. Users should update to the patched kernel version once available. No additional mitigation is indicated by the vendor advisory.