High 7.8Published Apr 24, 2026

CVE-2026-31665netfilter: nft_ct: fix use-after-free in timeout object destroy

Updated under an hour ago (Oct 28, 2026, 12:00 PM ET)

Does this affect you?

It affects Linux and 4 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix use-after-free in timeout object destroy nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data(). Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c. KASAN report: BUG: KASAN: slab-use-after-free in nf_conntrack_tcp_packet+0x1381/0x29d0 Read of size 4 at addr ffff8881035fe19c by task exploit/80 Call Trace: nf_conntrack_tcp_packet+0x1381/0x29d0 nf_conntrack_in+0x612/0x8b0 nf_hook_slow+0x70/0x100 __ip_local_out+0x1b2/0x210 tcp_sendmsg_locked+0x722/0x1580 __sys_sendto+0x2d8/0x320 Allocated by task 75: nft_ct_timeout_obj_init+0xf6/0x290 nft_obj_init+0x107/0x1b0 nf_tables_newobj+0x680/0x9c0 nfnetlink_rcv_batch+0xc29/0xe00 Freed by task 26: nft_obj_destroy+0x3f/0xa0 nf_tables_trans_destroy_work+0x51c/0x5c0 process_one_work+0x2c4/0x5a0

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7e0b2b57f01d183e1c84114f1f2287737358d748 before c458fc1c278a65ad5381083121d39a479973ebed; from 7e0b2b57f01d183e1c84114f1f2287737358d748 before c581e5c8f2b59158f62efe61c1a3dc36189081ff; from 7e0b2b57f01d183e1c84114f1f2287737358d748 before f16fe84879a5280f05ebbcea593a189ba0f3e79a; from 7e0b2b57f01d183e1c84114f1f2287737358d748 before 070abdf1b04325b21a20a2a0c39a2208af107275; from 7e0b2b57f01d183e1c84114f1f2287737358d748 before aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77; from 7e0b2b57f01d183e1c84114f1f2287737358d748 before b42aca3660dc2627a29a38131597ca610dc451f9; from 7e0b2b57f01d183e1c84114f1f2287737358d748 before d0983b48c10d1509fd795c155f8b1e832e1369ff; from 7e0b2b57f01d183e1c84114f1f2287737358d748 before f8dca15a1b190787bbd03285304b569631160eda	CNA record
Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP siemens:simatic_s7_1500_cpu_1518f_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP siemens:siplus_s7_1500_cpu_1518_4_pn_dp_mfp (from the name)	from V3.1.6	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.19.1 before 5.10.253; from 5.11 before 5.15.203; from 5.16 before 6.1.169; from 6.2 before 6.6.135; from 6.7 before 6.12.82; from 6.13 before 6.18.23; from 6.19 before 6.19.13; 4.19; and 7 more ranges	NVD

References

References

https://git.kernel.org/stable/c/c458fc1c278a65ad5381083121d39a479973ebed	patch
https://git.kernel.org/stable/c/c581e5c8f2b59158f62efe61c1a3dc36189081ff	patch
https://git.kernel.org/stable/c/f16fe84879a5280f05ebbcea593a189ba0f3e79a	patch
https://git.kernel.org/stable/c/070abdf1b04325b21a20a2a0c39a2208af107275	patch
https://git.kernel.org/stable/c/aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77	patch
https://git.kernel.org/stable/c/b42aca3660dc2627a29a38131597ca610dc451f9	patch
https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff	patch
https://git.kernel.org/stable/c/f8dca15a1b190787bbd03285304b569631160eda	patch
https://cert-portal.siemens.com/productcert/html/ssa-019113.html
https://cert-portal.siemens.com/productcert/html/ssa-082556.html
1–10 of 11

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.