7.1 Élevée

CVE-2026-31407 In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy…

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: add missing netlink policy validations Hyunwoo Kim reports out-of-bounds access in sctp and ctnetlink. These attributes are used by the kernel without any validation. Extend the netlink policies accordingly. Quoting the reporter: nlattr_to_sctp() assigns the user-supplied CTA_PROTOINFO_SCTP_STATE value directly to ct->proto.sctp.state without checking that it is within the valid range. [..] and: ... with exp->dir = 100, the access at ct->master->tuplehash[100] reads 5600 bytes past the start of a 320-byte nf_conn object, causing a slab-out-of-bounds read confirmed by UBSAN.

Produits et versions touchés

Produit	Versions touchées	Corrigé en
Linux 7.0	premières → < 7.0	7.0
Linux 6.19	premières → < 6.19.10	6.19.10
Linux 6.18	premières → < 6.18.24	6.18.24
Linux 6.12	premières → < 6.12.83	6.12.83
Linux 6.6	premières → < 6.6.136	6.6.136
Linux 6.1	premières → < 6.1.175	6.1.175
Linux 5.15	premières → < 5.15.209	5.15.209
Linux 5.10	premières → < 5.10.258	5.10.258
Linux	2.6.27	Pas de correctif indiqué