In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: fix helper UAF due to extensions realloc While calling the… (CVE-2026-98442)

The vulnerability in the Linux kernel's net/sched act_ct helper involved a use-after-free condition caused by reallocating the extensions area after a raw pointer to it was stored in the expectations list. Specifically, when a connection was not yet confirmed, additional extensions could be added, triggering a reallocation that invalidated the pointer in the list. This invalid pointer was later accessed during expectation removal, causing a UAF. The fix changes the order of operations to call helpers only after all extensions have been added, preventing the invalid pointer dereference. The helper rejection process still leaves marks and labels set, consistent with prior NAT and confirmation failure handling, and the API does not guarantee atomicity.

This vulnerability could lead to use-after-free memory access within the Linux kernel's network scheduling subsystem, potentially causing kernel crashes or undefined behavior. No active exploits are known. The impact is limited to kernel stability and security related to connection tracking helpers.

A fix has been implemented in the Linux kernel to address this use-after-free vulnerability by ensuring helpers are called only after all extensions are added. Users should apply the official kernel update containing this fix when available. No additional mitigation steps are indicated.