[SRU][J][PATCH 0/1] CVE-2026-31414

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-31414

[ Impact ]

The netfilter connection tracking expectation code in ctnetlink and /proc dumps
the helper name using nfct_help() without holding a reference to the master
conntrack. Accessing the helper this way is unsafe and can lead to a use-after-
free condition when the master conntrack is freed concurrently. This is
remotely exploitable and carries a CVSS score of 9.8, potentially allowing
memory corruption or privilege escalation.

[ Fix ]

jammy: backported with AI-assisted adaptation
bionic: backported with AI-assisted adaptation
trusty: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in this change would affect the netfilter nf_conntrack_expect
subsystem, potentially causing incorrect helper names to be reported in
ctnetlink or /proc output, or affecting expectation creation behaviour when
userspace does not supply an explicit helper.