Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_conntrack_expect: use conntrack GC to reap expectations This patch replaces the timer API by GC worker approach for expectations, as it already happened in many other subsystems. Use the existing conntrack GC worker to iterate over the local list of expectations in the master conntrack to reap expired expectations. Check IPS_HELPER_BIT to run GC for expectations, set it on for nft_ct expectation which nevers sets it. Hold the expectation spinlock while iterating over the master conntrack expectation list to synchronize with nf_ct_remove_expectations(). This also performs runtime packet path garbage collection through the expectation insertion and lookup functions while walking over one of the chains of the global expectation hashtables. Unconfirmed conntrack entries are skipped since ct->ext can be reallocated and dying are skipped since those will be gone soon. Set on IPS_HELPER_BIT if the helper ct extension is added, then the new GC worker does not need to bump the ct refcount to check if the ct->ext helper is available. This removes the extra bump on the refcount for expectation timers, this allows to remove several nf_ct_expect_put() calls after the unlink, after this update only refcount remains at 1 while on the expectation hashes. This patch implicitly addresses a race with the existing timer API allowing an expectation to access a stale exp->master pointer which has been already released when expectation removal loses races with an expiring timer, ie. timer_del() reporting false. Add a new NF_CT_EXPECT_DEAD flag to reap this expectation via GC. This is needed by nf_conntrack_unexpect_related() which is called in error paths to invalidate newly created expectations that has been added into the hashes. These expectactions cannot be inmediately released as GC or nf_ct_remove_expectations() could race to make it. On expectation insert, the runtime GC reaps stale expectations before checking the expectation limit set by policy. Set current timestamp in nf_ct_expect_alloc(), then add the expectation policy timeout (or custom timeout specified added on top of this) to specify the expectation lifetime.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-28T08:16:52.080Z",
  "pubdate": "2026-08-28T08:16:52.080Z",
  "executiveSummary": "This vulnerability involves a race condition within the Linux kernel's netfilter subsystem, specifically concerning the management of conntrack expectations.\nThe issue stems from the use of the legacy timer API for managing expectation lifetimes, which allowed for a race condition where an expectation could access a stale pointer (exp->master) after it had been released.\nThe vulnerability affects the nf_conntrack_expect component. It poses a risk of memory corruption or kernel panics if an attacker can trigger the race condition between the expectation removal process and the expiring timer.\nThe impact includes potential local denial-of-service (DoS) or, theoretically, local privilege escalation if the race is successfully exploited to manipulate kernel memory pointers.\nThe remediation involves shifting from a timer-based approach to a garbage collection (GC) worker model, improving synchronization during the reaping of expired or invalid expectations.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper synchronization between the nf_conntrack_expect timer API and the object lifecycle management of the master conntrack structure. Previously, the system relied on timer-based reaping of expectations, which created a race window during the execution of nf_ct_remove_expectations().\nIf a timer expiration coincided with a manual removal of an expectation, the system could lose the race, leading to a state where an expectation retained a stale pointer to its master conntrack (exp->master), even after the master object had been deallocated or freed.\nThis patch mitigates the flaw by replacing the timer-based management with the existing conntrack GC worker. By integrating expectation reaping into the GC worker, the kernel now iterates over the local list of expectations associated with a master conntrack. This approach ensures that the expectation spinlock is held during the entire iteration, providing necessary synchronization with concurrent removal calls.\nThe introduction of the NF_CT_EXPECT_DEAD flag serves as a critical synchronization mechanism, allowing the GC worker to safely identify and reap expectations that are undergoing an unexpect process or are trapped in error paths. This flag prevents race conditions when nf_conntrack_unexpect_related() is called, ensuring that expectations in the hashes are safely invalidated rather than immediately freed.\nAdditionally, the mechanism was updated to set the IPS_HELPER_BIT explicitly on conntrack entries when helpers are active. This removes the need for unnecessary reference count (refcount) increments for expectation timers. By streamlining the refcount logic, the kernel avoids the complex 'bump-and-put' cycles that previously contributed to synchronization fragility.\nThe runtime packet path now performs garbage collection during expectation insertion and lookup functions by traversing the chains of the global expectation hashtables. This proactive reaping minimizes the time stale entries remain in the system. The kernel now also skips unconfirmed conntrack entries to prevent issues with dynamic extension reallocation and ignores entries in the dying state, as these are scheduled for imminent removal.\nThe exploitation of this flaw would require an attacker to precisely time the insertion and removal of netfilter expectations to trigger the use-after-free (UAF) condition on the exp->master pointer. Successful exploitation typically results in kernel memory corruption or an oops, leading to a system crash."
}