Use-After-Free Vulnerability in Linux Kernel Netfilter Component

CVE-2026-31665

What is CVE-2026-31665?

A use-after-free vulnerability has been identified in the Linux kernel's netfilter component where a timeout object might be freed prematurely. This occurs during the execution of the nft_ct_timeout_obj_destroy() function, which calls kfree() without allowing for an RCU grace period. As a result, ongoing packet processing operations on different CPUs may still reference the timeout object, leading to potential system instability or crashes. The appropriate solution involves adding an rcu_head to the nf_ct_timeout structure and utilizing kfree_rcu() to ensure that the object is only freed after the RCU grace period has completed, thereby maintaining system integrity and preventing unintended access to deallocated memory.

References