In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: avoid modifying shared unconfirmed ct entry In a case where… (CVE-2026-98441)

The vulnerability in the Linux kernel's net/sched act_ct module involves the handling of skb packets with unconfirmed connection tracking (ct) entries that get cloned. When two clones are processed, each may attempt to commit or modify extensions differently, leading to a use-after-free (UAF) condition on the destruction path due to pointer corruption in the expectation list. The fix involves resetting the ct entry in cases where an skb with a shared unconfirmed ct entry is encountered, preventing unsafe modifications. This approach avoids breaking user API compatibility and does not affect typical network pipeline scenarios where processing both clones without modifications in the same zone is unnecessary.

The vulnerability can cause use-after-free conditions in the kernel's connection tracking code, potentially leading to kernel memory corruption. However, practical exploitation is unlikely because normal network pipelines do not process both clones without modifications in the same zone. No known exploits are reported in the wild.

A fix has been implemented in the Linux kernel to reset the unconfirmed ct entry when processing cloned skb packets, preventing unsafe shared modifications. Users should apply the official kernel updates containing this fix once available. Since this is a kernel-level issue, upgrading to a patched kernel version is the recommended remediation.