https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 28 Sep 2026 09:28:21 +0000 https://vulnerability.circl.lu/vuln/cve-2026-90237 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nft_ct: move custom expectation support to helper</p> <p>Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc (&#34;netfilter: nft_ct: skip expectations for confirmed conntrack&#34;) which restricted it to unconfirmed conntracks.</p> <p>However, early insertion of expectations into the expectations list when the conntrack is unconfirmed leads to stale entries pointing to the wrong hlist_head through .pprev due to ct extension reallocation.</p> <p>Commit 7c9664351980 (&#34;netfilter: move nat hlist_head to nf_conn&#34;) moved the nat hlist_head to nf_conn for this reason:</p> <p>1. ... 2. When reallocation of extension area occurs we need to fixup the bysource hash head via hlist_replace_rcu.</p> <p>I&#39;d rather not increase the size of the struct nf_conn for this feature has very limited scope: only one expectation can be created at a time given expect_clash() will make nf_ct_expect_related() reports EBUSY. For this reason, relax nf_ct_expect_related() not to drop packets in case expectation creation fails, therefore, expectation creation becomes best effort.</p> <p>To address this issue, add an internal ct helper and attach it to the conntrack entry to streamline the custom ct expectation support with existing ct helpers.</p> <p>Expose a new nf_conntrack_helper_release() function to release the internal helper that is al…</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: nft_ct: move custom expectation support to helper</p> <p>Originally, the ct expectation support called nf_ct_helper_ext_add() for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc (&#34;netfilter: nft_ct: skip expectations for confirmed conntrack&#34;) which restricted it to unconfirmed conntracks.</p> <p>However, early insertion of expectations into the expectations list when the conntrack is unconfirmed leads to stale entries pointing to the wrong hlist_head through .pprev due to ct extension reallocation.</p> <p>Commit 7c9664351980 (&#34;netfilter: move nat hlist_head to nf_conn&#34;) moved the nat hlist_head to nf_conn for this reason:</p> <p>1. ... 2. When reallocation of extension area occurs we need to fixup the bysource hash head via hlist_replace_rcu.</p> <p>I&#39;d rather not increase the size of the struct nf_conn for this feature has very limited scope: only one expectation can be created at a time given expect_clash() will make nf_ct_expect_related() reports EBUSY. For this reason, relax nf_ct_expect_related() not to drop packets in case expectation creation fails, therefore, expectation creation becomes best effort.</p> <p>To address this issue, add an internal ct helper and attach it to the conntrack entry to streamline the custom ct expectation support with existing ct helpers.</p> <p>Expose a new nf_conntrack_helper_release() function to release the internal helper that is al…</p> https://vulnerability.circl.lu/vuln/cve-2026-90237