{"api_version":"1","generated_at":"2026-10-01T06:48:58+00:00","cve":"CVE-2026-90237","urls":{"html":"https://cve.report/CVE-2026-90237","api":"https://cve.report/api/cve/CVE-2026-90237.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2026-90237","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-90237"},"summary":{"title":"netfilter: nft_ct: move custom expectation support to helper","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: move custom expectation support to helper\n\nOriginally, the ct expectation support called nf_ct_helper_ext_add() for\nconfirmed conntracks, which is invalid, triggering a splat. This was\nfixed by commit 1710eb913bdc (\"netfilter: nft_ct: skip expectations for\nconfirmed conntrack\") which restricted it to unconfirmed conntracks.\n\nHowever, early insertion of expectations into the expectations list when\nthe conntrack is unconfirmed leads to stale entries pointing to the\nwrong hlist_head through .pprev due to ct extension reallocation.\n\nCommit 7c9664351980 (\"netfilter: move nat hlist_head to nf_conn\") moved\nthe nat hlist_head to nf_conn for this reason:\n\n     1. ...\n     2. When reallocation of extension area occurs we need to fixup the\n        bysource hash head via hlist_replace_rcu.\n\nI'd rather not increase the size of the struct nf_conn for this feature\nhas very limited scope: only one expectation can be created at a time\ngiven expect_clash() will make nf_ct_expect_related() reports EBUSY.\nFor this reason, relax nf_ct_expect_related() not to drop packets in\ncase expectation creation fails, therefore, expectation creation becomes\nbest effort.\n\nTo address this issue, add an internal ct helper and attach it to the\nconntrack entry to streamline the custom ct expectation support with\nexisting ct helpers.\n\nExpose a new nf_conntrack_helper_release() function to release the\ninternal helper that is allocated and attached to the conntrack entry to\ncreate the custom expectations. The nft_ct module removal always waits\nfor rcu grace period, then the NULL helper callback is observed after\nthis.\n\nThis patch also restricts the creation of expectations to different\nhelpers other than this custom helper that is created for this type of\nexpectations.","state":"PUBLISHED","assigner":"Linux","published_at":"2026-09-17 17:17:19","updated_at":"2026-09-18 18:17:50"},"problem_types":[],"metrics":[{"version":"3.1","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"}},{"version":"3.1","source":"CNA","type":"DECLARED","score":"7.8","severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","data":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}}],"references":[{"url":"https://git.kernel.org/stable/c/af3fe52fd108fd38235e4813df62442ed0f1d8ff","name":"https://git.kernel.org/stable/c/af3fe52fd108fd38235e4813df62442ed0f1d8ff","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff","name":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff","refsource":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"title":"","mime":"","httpstatus":"","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-90237","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90237","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 857b46027d6f91150797295752581b7155b9d0e1 af3fe52fd108fd38235e4813df62442ed0f1d8ff git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 857b46027d6f91150797295752581b7155b9d0e1 3679da4ad8be84cddaf40bc307fef1fe13e051ff git","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"affected 5.3","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 5.3 semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.2.6 7.2.* semver","platforms":[]},{"source":"CNA","vendor":"Linux","product":"Linux","version":"unaffected 7.3-rc1 * original_commit_for_fix","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2026","cve_id":"90237","cve":"CVE-2026-90237","epss":"0.001540000","percentile":"0.049160000","score_date":"2026-09-21","updated_at":"2026-09-22 00:03:19"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"cna":{"affected":[{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_helper.h","net/netfilter/nf_conntrack_helper.c","net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"af3fe52fd108fd38235e4813df62442ed0f1d8ff","status":"affected","version":"857b46027d6f91150797295752581b7155b9d0e1","versionType":"git"},{"lessThan":"3679da4ad8be84cddaf40bc307fef1fe13e051ff","status":"affected","version":"857b46027d6f91150797295752581b7155b9d0e1","versionType":"git"}]},{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/netfilter/nf_conntrack_helper.h","net/netfilter/nf_conntrack_helper.c","net/netfilter/nft_ct.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.3"},{"lessThan":"5.3","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"7.2.*","status":"unaffected","version":"7.2.6","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.3-rc1","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.2.6","versionStartIncluding":"5.3","vulnerable":true},{"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndExcluding":"7.3-rc1","versionStartIncluding":"5.3","vulnerable":true}],"negate":false,"operator":"OR"}]}],"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: move custom expectation support to helper\n\nOriginally, the ct expectation support called nf_ct_helper_ext_add() for\nconfirmed conntracks, which is invalid, triggering a splat. This was\nfixed by commit 1710eb913bdc (\"netfilter: nft_ct: skip expectations for\nconfirmed conntrack\") which restricted it to unconfirmed conntracks.\n\nHowever, early insertion of expectations into the expectations list when\nthe conntrack is unconfirmed leads to stale entries pointing to the\nwrong hlist_head through .pprev due to ct extension reallocation.\n\nCommit 7c9664351980 (\"netfilter: move nat hlist_head to nf_conn\") moved\nthe nat hlist_head to nf_conn for this reason:\n\n     1. ...\n     2. When reallocation of extension area occurs we need to fixup the\n        bysource hash head via hlist_replace_rcu.\n\nI'd rather not increase the size of the struct nf_conn for this feature\nhas very limited scope: only one expectation can be created at a time\ngiven expect_clash() will make nf_ct_expect_related() reports EBUSY.\nFor this reason, relax nf_ct_expect_related() not to drop packets in\ncase expectation creation fails, therefore, expectation creation becomes\nbest effort.\n\nTo address this issue, add an internal ct helper and attach it to the\nconntrack entry to streamline the custom ct expectation support with\nexisting ct helpers.\n\nExpose a new nf_conntrack_helper_release() function to release the\ninternal helper that is allocated and attached to the conntrack entry to\ncreate the custom expectations. The nft_ct module removal always waits\nfor rcu grace period, then the NULL helper callback is observed after\nthis.\n\nThis patch also restricts the creation of expectations to different\nhelpers other than this custom helper that is created for this type of\nexpectations."}],"metrics":[{"cvssV3_1":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"scenarios":[{"lang":"en","value":"AV:L - The triggering state is created by a local NFT_MSG_NEWOBJ (nf_tables_newobj) of type NFT_OBJECT_CT_EXPECT plus an objref rule; nft_objref_eval then calls nft_ct_expect_obj_eval from nft_do_chain_ipv4 on a packet the attacker sends in their netns. No remote protocol field carries the malformed expectation-list linkage.\nAC:L - After nf_ct_expect_insert stores exp->lnode into nf_conn_help.expectations, the attacker’s later expressions on the same packet (nft_ct_timeout_obj_eval, nft_ct_set_eval NFT_CT_EVENTMASK, or nft_nat_eval → nf_nat_setup_info → nfct_seqadj_ext_add) call nf_ct_ext_add so krealloc moves ct->ext; that rule order is attacker-chosen and needs no race.\nPR:L - nfnetlink_rcv admits the NFT_MSG_NEWOBJ/NEWRULE batch only after netlink_net_capable(skb, CAP_NET_ADMIN) against sock_net(skb->sk)->user_ns, which an unprivileged user gets via unshare -Urn; nft_ct_expect_obj_init has no extra init-namespace capability check.\nUI:N - The attacker installs the ct expectation object and objref rule themselves, then emits their own UDP/TCP packet so nft_do_chain_ipv4 at NF_INET_LOCAL_OUT reaches nft_ct_expect_obj_eval; no other user must mount, open a file, or confirm the ruleset.\nS:U - krealloc of ct->ext leaves a dangling hlist_node.pprev in the host kernel heap (nf_conn_help.expectations); impact is in-kernel memory corruption on the same host, not a KVM/Xen guest-to-host escape or IOMMU/DMA bypass.\nC:H - After nf_ct_ext_add’s krealloc frees the old nf_conn_help, exp->lnode.pprev still addresses that slab; spraying it and then walking help->expectations in nf_ct_remove_expectations is a use-after-free read of reused kernel memory.\nI:H - nf_ct_unlink_expect_report’s hlist_del_rcu(&exp->lnode) writes the next pointer through the stale pprev into the freed helper extension, a heap write primitive that can be groomed for control-flow hijack.\nA:H - The same dangling pprev is used when the conntrack is destroyed (clean_from_lists → nf_ct_remove_expectations) or the expectation is unlinked, which oopses or panics if the old ct->ext slab was reused or poisoned."}]}],"providerMetadata":{"dateUpdated":"2026-09-18T17:54:03.145Z","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux"},"references":[{"url":"https://git.kernel.org/stable/c/af3fe52fd108fd38235e4813df62442ed0f1d8ff"},{"url":"https://git.kernel.org/stable/c/3679da4ad8be84cddaf40bc307fef1fe13e051ff"}],"title":"netfilter: nft_ct: move custom expectation support to helper","x_generator":{"engine":"bippy-1.2.0"}}},"cveMetadata":{"assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","assignerShortName":"Linux","cveId":"CVE-2026-90237","datePublished":"2026-09-17T16:07:42.524Z","dateReserved":"2026-09-11T19:38:34.794Z","dateUpdated":"2026-09-18T17:54:03.145Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-09-17 17:17:19","lastModifiedDate":"2026-09-18 18:17:50","problem_types":[],"metrics":{"cvssMetricV31":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"90237","Ordinal":"1","Title":"netfilter: nft_ct: move custom expectation support to helper","CVE":"CVE-2026-90237","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"90237","Ordinal":"1","NoteData":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_ct: move custom expectation support to helper\n\nOriginally, the ct expectation support called nf_ct_helper_ext_add() for\nconfirmed conntracks, which is invalid, triggering a splat. This was\nfixed by commit 1710eb913bdc (\"netfilter: nft_ct: skip expectations for\nconfirmed conntrack\") which restricted it to unconfirmed conntracks.\n\nHowever, early insertion of expectations into the expectations list when\nthe conntrack is unconfirmed leads to stale entries pointing to the\nwrong hlist_head through .pprev due to ct extension reallocation.\n\nCommit 7c9664351980 (\"netfilter: move nat hlist_head to nf_conn\") moved\nthe nat hlist_head to nf_conn for this reason:\n\n     1. ...\n     2. When reallocation of extension area occurs we need to fixup the\n        bysource hash head via hlist_replace_rcu.\n\nI'd rather not increase the size of the struct nf_conn for this feature\nhas very limited scope: only one expectation can be created at a time\ngiven expect_clash() will make nf_ct_expect_related() reports EBUSY.\nFor this reason, relax nf_ct_expect_related() not to drop packets in\ncase expectation creation fails, therefore, expectation creation becomes\nbest effort.\n\nTo address this issue, add an internal ct helper and attach it to the\nconntrack entry to streamline the custom ct expectation support with\nexisting ct helpers.\n\nExpose a new nf_conntrack_helper_release() function to release the\ninternal helper that is allocated and attached to the conntrack entry to\ncreate the custom expectations. The nft_ct module removal always waits\nfor rcu grace period, then the NULL helper callback is observed after\nthis.\n\nThis patch also restricts the creation of expectations to different\nhelpers other than this custom helper that is created for this type of\nexpectations.","Type":"Description","Title":"netfilter: nft_ct: move custom expectation support to helper"}]}}}