ACK: [SRU][J][PATCH 0/1] CVE-2026-31414

[Hui Wang]

Acked-by: Hui Wang <hui.wang at canonical.com>

On 6/24/26 08:38, Cengiz Can via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-31414
>
> [ Impact ]
>
> The netfilter connection tracking expectation code in ctnetlink and /proc dumps
> the helper name using nfct_help() without holding a reference to the master
> conntrack. Accessing the helper this way is unsafe and can lead to a use-after-
> free condition when the master conntrack is freed concurrently. This is
> remotely exploitable and carries a CVSS score of 9.8, potentially allowing
> memory corruption or privilege escalation.
>
> [ Fix ]
>
> jammy: backported with AI-assisted adaptation
> bionic: backported with AI-assisted adaptation
> trusty: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change would affect the netfilter nf_conntrack_expect
> subsystem, potentially causing incorrect helper names to be reported in
> ctnetlink or /proc output, or affecting expectation creation behaviour when
> userspace does not supply an explicit helper.
>