Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix use-after-free in ctnetlinkdumpexpct The ctnetlinkdumpexpct function stores a conntrack pointer in cb-data for the netlink dump callback ctnetlinkexpctdumptable. However, the conntrack reference is dropp...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nfconntrackexpect: Use expect-helper. Use expect-helper in ctnetlink and /proc to dump the helper’s name. Using nfcthelp without holding a reference to the master conntrack is unsafe. Use exp-master-helper in the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: ctnetlink: Use netlink policy range checks. Replace manual range and mask validations with netlink policy annotations in ctnetlink code paths. This ensures that netlink core rejects invalid values early and can...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: remove refcounting in expectation dumpers The pattern is the same as the previous patch: do not keep the expectation object alive via refcount; instead, only store a cookie value and then use that as a hint...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helpers under new expectations The existing master conntrack helper should be used; anything else is not truly supported, and it only complicates validation. Therefore, ignore whatever helper...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: Fields related to NAT expectations are set to zero when CTAEXPECTNAT is not present. The ctnetlinkallocexpect function allocates expectations from a non-zeroing slab cache via nfctexpectalloc. When...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: Use a helper function to calculate the expected ID. The deletion of the expectation path requires a call to the nfexpectgetid helper function to calculate the expected ID. Otherwise, the ID of the expectatio...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053398)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053398 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: use helper function to calculate expect ID Delete expectation path is missi...

kernel: netfilter: ctnetlink: ensure safe access to master conntrack

A flaw was found in the netfilter: ctnetlink component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition,...

kernel: netfilter: ctnetlink: ensure safe access to master conntrack

A flaw was found in the netfilter: ctnetlink component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition,...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098785)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098785 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrac...

Astra Linux – Vulnerability in Linux

In the Linux kernel up to version 5.8.7, local attackers who were able to inject conntrack netlink configurations could exploit an overflow in a local buffer, resulting in crashes or triggering the use of incorrect protocol numbers in ctnetlinkparsetuplefilter in net/netfilter/nfconntracknetlink....

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: fix refcount leak on table dump There is a reference count leak in ctnetlinkdumptable: c if res ctgeneral; // HERE cb-args1 = unsigned longct; ... While it’s very unlikely, it’s possible that ct could be equ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102132)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102132 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: ctnetlink: ignore explicit helper on new expectations Use the existing master conntrac...

EulerOS 2.0 SP15 : kernel (EulerOS-SA-2026-2889)

According to the versions of the kernel packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : mm: blk-cgroup: fix use-after-free in cgwbreleaseworkfnCVE-2026-31586 e1000/e1000e: Fix leak in DMA error cleanupCVE-2026-43445 futex: Clear stale...

kernel security update

An update is available for kernel. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The kernel packages contain the Linux kernel, the core of any Linux operating...

kernel: netfilter: ctnetlink: ensure safe access to master conntrack

A flaw was found in the netfilter: ctnetlink component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition,...

kernel: netfilter: ctnetlink: ensure safe access to master conntrack

A flaw was found in the netfilter: ctnetlink component of the Linux kernel. This vulnerability occurs due to insufficient locking when accessing the master conntrack object, allowing it to become invalid while still being referenced. A local attacker could potentially exploit this race condition,...

RHEL 8 : kernel (RHSA-2026:49214)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49214 advisory. The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtnetlink: add missing...

RHEL 8 : kernel-rt (RHSA-2026:49213)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:49213 advisory. The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism...