CVE-2026-31495

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: ctnetlink: use netlink policy range checks<br /> <br /> Replace manual range and mask validations with netlink policy<br /> annotations in ctnetlink code paths, so that the netlink core rejects<br /> invalid values early and can generate extack errors.<br /> <br /> - CTA_PROTOINFO_TCP_STATE: reject values &gt; TCP_CONNTRACK_SYN_SENT2 at<br /> policy level, removing the manual &gt;= TCP_CONNTRACK_MAX check.<br /> - CTA_PROTOINFO_TCP_WSCALE_ORIGINAL/REPLY: reject values &gt; TCP_MAX_WSCALE<br /> (14). The normal TCP option parsing path already clamps to this value,<br /> but the ctnetlink path accepted 0-255, causing undefined behavior when<br /> used as a u32 shift count.<br /> - CTA_FILTER_ORIG_FLAGS/REPLY_FLAGS: use NLA_POLICY_MASK with<br /> CTA_FILTER_F_ALL, removing the manual mask checks.<br /> - CTA_EXPECT_FLAGS: use NLA_POLICY_MASK with NF_CT_EXPECT_MASK, adding<br /> a new mask define grouping all valid expect flags.<br /> <br /> Extracted from a broader nf-next patch by Florian Westphal, scoped to<br /> ctnetlink for the fixes tree.