Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: netfilter: nftct: Fixed a use-after-free in the destroy function for timeout objects. The nftcttimeoutobjDestroy function frees the timeout object using kfree, immediately after nfcttimeoutout, without waiting for an RCU grace...

SUSE CVE-2026-90237

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

Linux Distros Unpatched Vulnerability : CVE-2026-90237

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is...

DEBIAN-CVE-2026-90237

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

CVE-2026-90237

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

AZL-102491 CVE-2026-90237 affecting package kernel 6.6.159.1-1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

CVE-2026-90237 netfilter: nft_ct: move custom expectation support to helper

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

CVE-2026-90237 netfilter: nft_ct: move custom expectation support to helper

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

CVE-2026-90237

CVE-2026-90237 affects the Linux kernel in the netfilter nft_ct module. The root cause is that early insertion of expectations into the expectations list for unconfirmed conntracks leads to stale entries pointing to the wrong hlist_head through .pprev due to conntrack extension reallocation. The ...

EUVD-2026-81830

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

CVE-2026-90237: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: move custom expectation support to helper Originally, the ct expectation support called nfcthelperextadd for confirmed conntracks, which is invalid, triggering a splat. This was fixed by commit 1710eb913bdc...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: Dropping enqueued packets during removal. Packets stored in nfqueue may retain a reference to the following objects: - Templates that specify the conntrack zone, as a percpu area is used, and module removal is...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098774)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098774 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098737)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098737 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: add seqadj extension for natted connections Sequence adjustment may be required...

K000163080: Linux kernel vulnerability CVE-2026-53267

Security Advisory Description In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: bail out on template ct in get eval I noticed this issue while looking at a historic syzbot report 1. A rule like the one below is enough to trigger the bug: table ip t chain pre ty...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-102135)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-102135 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: add seqadj extension for natted connections Sequence adjustment may be required...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-099749)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099749 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: drop pending enqueued packets on removal Packets sitting in nfqueue might hold ...

Unity Linux 20.1050e Security Update: kernel (UTSA-2026-100128)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100128 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix missing expect put in obj eval nftctexpectobjeval allocates an expectation...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-100740)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-100740 advisory. In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix missing expect put in obj eval nftctexpectobjeval allocates an expectation...

SUSE CVE-2026-52970

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftct: fix missing expect put in obj eval nftctexpectobjeval allocates an expectation and may call nfctexpectrelated, but never drops its local reference. Add nfctexpectputexp before return to balance allocation...