01 Record

CVE-2026-98873

netfilter: nf_conntrack_expect: zero at allocation time

UnratedPUBLISHEDCNA: Linux

CNA base scoreUnratedNo CNA CVSS vector

View raw JSON

02 Description

netfilter: nf_conntrack_expect: zero at allocation time

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.17% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 7.3% of scored records. A rank, not a probability.
NVD base score: The NVD has published no score for this record
NVD CVSS vector: No NVD score to derive
NVD analysis status: Received. NVD last modified this record on 2026-10-26.
Red Hat severity: Low. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-10-23 11:37Z5 DAYS AGO

Last updated

2026-10-26 06:55Z3 DAYS AGO

Reserved

2026-09-25

Assigning CNA

Linux

Record state

PUBLISHED

Severity

Not rated by the issuing CNA

CNA CVSS vector

Not published by the issuing CNA

Weaknesses

CWE-908Use of Uninitialized ResourceBase

Data version

5.2

Document digest

8d6503458349c3136c0880ff2c078508148a5bef26d6bd02bcb05e9b4321e7e5

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux076a0ca02644657b13e4af363f487ced2942e9cb to < 39cb6ff947c16a576ea68c5f272e634acdcb0085, 076a0ca02644657b13e4af363f487ced2942e9cb to < 90545aa07a183887e9d72ce573c18e08f62e2c91, 076a0ca02644657b13e4af363f487ced2942e9cb to < 9c11d7ea5ff4dbe162e79f00188814ef5483c295, 076a0ca02644657b13e4af363f487ced2942e9cb to < b7f3ee925aee9f1f547d539bc03c35433c238958, 076a0ca02644657b13e4af363f487ced2942e9cb to < 824397af7bfe14edad374c64253dae0187ca623d, 076a0ca02644657b13e4af363f487ced2942e9cb to < a39ecb856514274c80d0fac4d128dba6b266a8ed, 076a0ca02644657b13e4af363f487ced2942e9cb to < 241ccd2fed9051db443aadce248fc0ab30f55e97, 3.4—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/39cb6ff947c16a576ea68c5f272e634acdcb0085
git.kernel.orghttps://git.kernel.org/stable/c/90545aa07a183887e9d72ce573c18e08f62e2c91
git.kernel.orghttps://git.kernel.org/stable/c/9c11d7ea5ff4dbe162e79f00188814ef5483c295
git.kernel.orghttps://git.kernel.org/stable/c/b7f3ee925aee9f1f547d539bc03c35433c238958
git.kernel.orghttps://git.kernel.org/stable/c/824397af7bfe14edad374c64253dae0187ca623d
git.kernel.orghttps://git.kernel.org/stable/c/a39ecb856514274c80d0fac4d128dba6b266a8ed
git.kernel.orghttps://git.kernel.org/stable/c/241ccd2fed9051db443aadce248fc0ab30f55e97

07 Fixed in

Debian 12

linux
Fixed in 6.1.190-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.