ACK: [SRU][Q/J][PATCH 0/2] CVE-2026-31414

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/23/26 12:32, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-31414
>
> [ Impact ]
>
> The netfilter conntrack expectation code dumps the helper name in the ctnetlink
> and /proc paths by calling nfct_help() on the master conntrack without holding
> a reference to it. Accessing the helper this way is unsafe and can lead to a
> use-after-free when the master conntrack is freed concurrently. An attacker
> could exploit this race to corrupt memory or disclose kernel data, with
> potential for remote code execution given the high CVSS score of 9.8.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
> jammy: backported with AI-assisted adaptation
> focal: backported with AI-assisted adaptation
> bionic: backported with AI-assisted adaptation
> xenial: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change would affect the netfilter nf_conntrack_expect
> subsystem, potentially causing incorrect helper names to be reported in
> ctnetlink and /proc output, or breaking expectation creation when userspace
> does not supply an explicit helper.
>