{"id":"CVE-2026-98873","kind":"vulnerability","aliases":["CVE-2026-98873"],"related":[],"title":"Linux kernel: uninitialized conntrack expectation memory could leak to userspace","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_conntrack_expect: zero at allocation time\n\nThere are occasional LLM hints wrt. leaking uninitialized data to\nuserspace via ctnetlink.  Just zero at allocation time,\nexpectations are not frequently used these days.\n\nIntentionally keeps _init as-is because we could theoretically\nsupport re-init, so add the missing exp->dir there.","summary":"The Linux kernel's netfilter connection tracking code allocated expectation structures without zeroing them, so leftover memory could be reported to userspace through ctnetlink. The fix zeroes the structure at allocation time and sets the missing direction field on re-initialization.","severity":"unknown","cvss":null,"epss":0.00215,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ctnetlink","infrastructure","linux","netfilter"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T05:00:15+00:00","updated_at":"2026-10-25T12:38:51+00:00","category":"infrastructure","confidence":0.4,"triage":{"at":"2026-10-25T05:00:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: uninitialized conntrack expectation memory could leak to userspace","impact":"low","summary":"The Linux kernel's netfilter connection tracking code allocated expectation structures without zeroing them, so leftover memory could be reported to userspace through ctnetlink. The fix zeroes the structure at allocation time and sets the missing direction field on re-initialization.","category":"infrastructure","nicknames":[],"who_cares":["linux","netfilter","ctnetlink"],"confidence":0.4,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the upstream kernel commit and NVD entry for affected kernel versions, fixed stable versions, and whether ctnetlink exposure requires CAP_NET_ADMIN.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000519,"input_tokens":3360,"output_tokens":365,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98873':13A,16A 'add':121C 'alloc':29B,51B,79C,97C 'as-i':109C 'code':28B 'connect':26B 'conntrack':4A,75C 'could':7A,38B,114C 'ctnetlink':17B,44B,93C 'cve':11A,14A 'data':89C 'day':105C 'dir':125C 'direct':57B 'exp':124C 'expect':5A,30B,76C,99C 'field':58B 'fix':46B 'follow':68C 'frequent':102C 'hint':85C 'infrastructur':18B 'init':108C,119C 'initi':62B 'intent':106C 'keep':107C 'kernel':2A,23B,66C 'leak':8A,87C 'leftov':36B 'linux':1A,19B,22B,65C 'llm':84C 'memori':6A,37B 'miss':56B,123C 'netfilt':20B,25B,73C 'nf':74C 'occasion':83C 're':61B,118C 're-init':117C 're-initi':60B 'report':40B 'resolv':72C 'set':54B 'structur':31B,49B 'support':116C 'theoret':115C 'time':52B,80C,98C 'track':27B 'uniniti':3A,88C 'use':103C 'userspac':10A,42B,91C 'via':92C 'vulner':69C 'without':32B 'wrt':86C 'zero':33B,47B,77C,95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T12:18:20+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98873","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98873","severity":null,"published_at":"2026-10-23T12:18:20+00:00","modified_at":"2026-10-23T12:18:20+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-98873","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-98873","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}