EUVD-2026-103731

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98491

A vulnerability in the Linux kernel (net: openvswitch: conntrack) allows for a Use-After-Free (UAF) condition. The issue occurs when a socket buffer (skb) with an unconfirmed conntrack (ct) entry is cloned. If both clones attempt to commit while possessing different sets of extensions, the second...

CVE-2026-98491 net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry In a case where skb with an unconfirmed ct entry gets cloned, we may end up committing both but with different sets of extensions. The series of events: 1...

CVE-2026-98490

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

EUVD-2026-103730

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...

CVE-2026-98490

The Linux kernel contains a Use-After-Free (UAF) vulnerability within the net: openvswitch: conntrack component. The issue arises because a raw pointer to the extensions area is inserted into the expectations list during helper calls. If a connection is not yet confirmed, subsequent calls to *_ex...

CVE-2026-98490 net: openvswitch: conntrack: fix helper UAF due to extensions realloc

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: conntrack: fix helper UAF due to extensions realloc While calling the helpers, a raw pointer to the extensions area is wired into expectations list: - nfcthelper - helper-help - nfctexpectrelatedreport -...