[SRU][Q/J][PATCH 0/2] CVE-2026-31414

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-31414

[ Impact ]

The netfilter conntrack expectation code dumps the helper name in the ctnetlink
and /proc paths by calling nfct_help() on the master conntrack without holding
a reference to it. Accessing the helper this way is unsafe and can lead to a
use-after-free when the master conntrack is freed concurrently. An attacker
could exploit this race to corrupt memory or disclose kernel data, with
potential for remote code execution given the high CVSS score of 9.8.

[ Fix ]

questing: backported with AI-assisted adaptation
jammy: backported with AI-assisted adaptation
focal: backported with AI-assisted adaptation
bionic: backported with AI-assisted adaptation
xenial: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change would affect the netfilter nf_conntrack_expect
subsystem, potentially causing incorrect helper names to be reported in
ctnetlink and /proc output, or breaking expectation creation when userspace
does not supply an explicit helper.