---
id: "CVE-2026-98873"
kind: "vulnerability"
aliases: ["CVE-2026-98873"]
title: "Linux kernel: uninitialized conntrack expectation memory could leak to userspace"
severity: "unknown"
cvss: null
epss: 0.00215
exploited: false
status: "open"
category: "infrastructure"
products: []
ecosystems: []
tags: ["ctnetlink", "infrastructure", "linux", "netfilter"]
not_affected_if: []
published_at: "2026-10-23T12:18:20+00:00"
first_seen_at: "2026-10-23T21:57:33+00:00"
updated_at: "2026-10-25T12:38:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98873", "first_seen_at": "2026-10-23T21:57:33+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-98873", "first_seen_at": "2026-10-25T12:38:51+00:00"}]
---

# Linux kernel: uninitialized conntrack expectation memory could leak to userspace

The Linux kernel's netfilter connection tracking code allocated expectation structures without zeroing them, so leftover memory could be reported to userspace through ctnetlink. The fix zeroes the structure at allocation time and sets the missing direction field on re-initialization.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-10-23T21:57:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98873
- 2026-10-25T12:38:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-98873

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_conntrack_expect: zero at allocation time

There are occasional LLM hints wrt. leaking uninitialized data to
userspace via ctnetlink.  Just zero at allocation time,
expectations are not frequently used these days.

Intentionally keeps _init as-is because we could theoretically
support re-init, so add the missing exp->dir there.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_