conntrack ctnetlink

The conntrack ctnetlink tag covers discussions about the Linux kernel's connection tracking netlink interface, particularly around security vulnerabilities and validation fixes. Recent content focuses on CVE-2026-31495, a kernel flaw where the ctnetlink path accepted malformed netlink values, allowing invalid state, mask, and shift inputs to reach conntrack logic before proper policy enforcement. The fix moved validation into the netlink policy layer for faster failure and better error reporting. This tag is relevant for system administrators, security researchers, and developers working with Linux networking, kernel hardening, or connection tracking subsystems.