PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31665 Linux CVE debrief

A use-after-free vulnerability was found in the Linux kernel's netfilter component. The nft_ct_timeout_obj_destroy function was freeing the timeout object immediately after nf_ct_untimeout, without waiting for an RCU grace period. This could allow concurrent packet processing on other CPUs to still hold RCU-protected references to the timeout object, leading to a potential crash or code execution. The fix adds an rcu_head to struct nf_ct_timeout and uses kfree_rcu to defer freeing until after an RCU grace period, matching the approach already used in nfnetlink_cttimeout.c.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-14
Original CVE updated
2026-07-28
Advisory published
2026-07-14
Advisory updated
2026-07-28

Who should care

Linux kernel developers, users, network administrators, and security teams who manage Linux-based systems should be aware of this vulnerability and take necessary actions to protect their systems, especially those with exposed network interfaces or involved in network packet processing. They should apply the patch to the Linux kernel, use a supported and patched version, monitor for potential crashes or unusual behavior, review compensating controls for exposed systems, check relevant monitoring and logs, and track exceptions and retest remediated assets.

Technical summary

The vulnerability exists in the Linux kernel's netfilter component, specifically in the nft_ct_timeout_obj_destroy function. This function was freeing the timeout object immediately after nf_ct_untimeout, without waiting for an RCU grace period. This could allow concurrent packet processing on other CPUs to still hold RCU-protected references to the timeout object, leading to a potential crash or code execution.

Defensive priority

High

Recommended defensive actions

  • Apply the patch to the Linux kernel
  • Use a supported and patched version of the Linux kernel
  • Monitor for potential crashes or unusual behavior
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported and patched by the Linux kernel developers. The fix was backported to various stable kernel versions. Evidence is limited, and defenders should verify patch application and monitor for potential crashes or unusual behavior.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31665 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31665

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31665 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31665

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/070abdf1b04325b21a20a2a0c39a2208af107275

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/aa7cfa16f98f8ec3e6d47c34e1a8c1ae4b9b8b77

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/b42aca3660dc2627a29a38131597ca610dc451f9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c458fc1c278a65ad5381083121d39a479973ebed

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/c581e5c8f2b59158f62efe61c1a3dc36189081ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d0983b48c10d1509fd795c155f8b1e832e1369ff

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/f16fe84879a5280f05ebbcea593a189ba0f3e79a

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.