Use-after-free in Linux kernel - CVE-2026-98251

Vulnerability details

The vulnerability allows a local user to cause access to freed kernel memory.

The vulnerability exists due to use-after-free in ovs_ct_get_conn_labels() when adding a labels extension to a confirmed conntrack entry while another CPU accesses its extension block. A local user can trigger label extension allocation during concurrent access to cause access to freed kernel memory.

Exploitation requires a confirmed conntrack entry that does not already have a labels extension.

Affected software

How to mitigate CVE-2026-98251

External References

• https://git.kernel.org/stable/c/05eab8dced6bf4d3009a6eeee16ddac99047dc83
• https://git.kernel.org/stable/c/2e6dd889c325abf23821e1459c3ffef59b7f0009
• https://git.kernel.org/stable/c/3f118c8217c109fd13ca61caa301d72c483897ef
• https://git.kernel.org/stable/c/4371d79ea74407fb992c985b1f94391e35bb8289
• https://git.kernel.org/stable/c/579d87ec1e1e85729a6cb2c25961e58beb78640c
• https://git.kernel.org/stable/c/7ff688aceada1160331a789385ea146f62fbddf7
• https://git.kernel.org/stable/c/8c9fcc6c33950d3db551af664d1fd3d998bfee56
• https://git.kernel.org/stable/c/d16f089bd700f45d720ce989d5495e1dc3be0cf8

Related Security Bulletins

• Use-after-free in Linux kernel openvswitch
• Debian update for linux