CVE-2026-31665

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_ct: fix use-after-free in timeout object destroy nft_ct_timeout_obj_destroy() frees the timeout object with kfree() immediately after nf_ct_untimeout(), without waiting for an RCU grace period. Concurrent packet processing on other CPUs may still hold RCU-protected references to the timeout object obtained via rcu_dereference() in nf_ct_timeout_data(). Add an rcu_head to struct nf_ct_timeout and use kfree_rcu() to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_c...

Affected product and versions

Product

Linux Linux, SIMATIC S7-1500 CPU 1518-4 PN/DP MFP, SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP

Affected versions

>= 7e0b2b57f01d183e1c84114f1f2287737358d748 < c458fc1c278a65ad5381083121d39a479973ebed, >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < c581e5c8f2b59158f62efe61c1a3dc36189081ff, >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < f16fe84879a5280f05ebbcea593a189ba0f3e79a, >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < 070abdf1b04325b21a20a2a0c39a2208af107275, >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77, >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < b42aca3660dc2627a29a38131597ca610dc451f9, >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < d0983b48c10d1509fd795c155f8b1e832e1369ff, >= 7e0b2b57f01d183e1c84114f1f2287737358d748 < f8dca15a1b190787bbd03285304b569631160eda, >= 4.19, >= V3.1.6, >= V3.1.5, >= 4.19.1 < 5.10.253, >= 5.11 < 5.15.203, >= 5.16 < 6.1.169, >= 6.2 < 6.6.135, >= 6.7 < 6.12.82, >= 6.13 < 6.18.23, >= 6.19 < 6.19.13, 4.19, 7.0

Fixed versions

5.10.253, 5.15.203, 6.1.169, 6.6.135, 6.12.82, 6.18.23, 6.19.13

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416