ACK: [SRU][Q][PATCH 0/2] CVE-2026-31414

[Jian Hui Lee]

Acked-by: Jian Hui Lee <jianhui.lee at canonical.com>

On Tue, Jun 23, 2026 at 12:33 PM Cengiz Can via kernel-team
<kernel-team at lists.ubuntu.com> wrote:
>
> https://ubuntu.com/security/CVE-2026-31414
>
> [ Impact ]
>
> The netfilter conntrack expectation code dumps the helper name in the ctnetlink
> and /proc paths by calling nfct_help() on the master conntrack without holding
> a reference to it. Accessing the helper this way is unsafe and can lead to a
> use-after-free when the master conntrack is freed concurrently. An attacker
> could exploit this race to corrupt memory or disclose kernel data, with
> potential for remote code execution given the high CVSS score of 9.8.
>
> [ Fix ]
>
> questing: backported with AI-assisted adaptation
> jammy: backported with AI-assisted adaptation
> focal: backported with AI-assisted adaptation
> bionic: backported with AI-assisted adaptation
> xenial: backported with AI-assisted adaptation
>
> [ Test Plan ]
>
> Boot tested.
>
> [ Where Problems Could Occur ]
>
> A regression in this change would affect the netfilter nf_conntrack_expect
> subsystem, potentially causing incorrect helper names to be reported in
> ctnetlink and /proc output, or breaking expectation creation when userspace
> does not supply an explicit helper.
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team