{"id":"CVE-2026-98484","kind":"vulnerability","aliases":["CVE-2026-98484"],"related":[],"title":"Linux kernel: expired nftables catchall entries block re-insertion and deletion","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_tables: skip expired catchall elements on insert and delete\n\nnft_setelem_catchall_insert() looks up duplicates with\nnft_set_elem_active() only, while nft_set_catchall_lookup() and the\ndump path additionally skip expired elements.\n\nOnce a catchall element with a timeout expires, this predicate drift\nmakes it invisible to userspace dumps, yet it still blocks\nre-insertion: with NLM_F_EXCL the request fails with -EEXIST, and\nwithout it the request reports success but silently inserts nothing.\nThe stale entry only goes away when the (user-tunable) gc interval\nelapses, so the catchall rule may silently stop matching for an\narbitrarily long time after its first expiration.\n\nThe delete path shows the same drift: nft_setelem_catchall_deactivate()\npicks the first active-next entry in the catchall list, so with an\nexpired entry still pending GC it retires the stale entry instead of\nthe fresh one, and it deactivates an element that userspace no longer\nsees instead of failing with -ENOENT.\n\nAlign both walks with the lookup and dump predicates: only an element\nthat is active and not expired counts as a duplicate or delete\ncandidate, using the per-netns timestamp taken at transaction start,\nin line with the set backend .insert/.deactivate and catchall GC sync\npaths.","summary":"In the Linux kernel's nf_tables firewall, expired catchall set elements stay visible to the insert and delete code paths while userspace dumps hide them. A rule can silently stop matching or delete the wrong entry until the garbage-collection interval passes.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","netfilter","nftables","self-hosted"],"not_affected_if":["no-nftables-catchall-timeouts"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the NVD entry (unknown in the sources provided).\n- Check whether nftables sets with catchall elements and timeouts are in use: `nft list ruleset | grep -i catchall`.","fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98484 (exact version unknown in the sources).","status":"open","published_at":"2026-10-18T16:16:59+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:49+00:00","updated_at":"2026-10-25T05:25:49+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:25:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix for CVE-2026-98484 (exact version unknown in the sources).","reach":"local","title":"Linux kernel: expired nftables catchall entries block re-insertion and deletion","impact":"low","summary":"In the Linux kernel's nf_tables firewall, expired catchall set elements stay visible to the insert and delete code paths while userspace dumps hide them. A rule can silently stop matching or delete the wrong entry until the garbage-collection interval passes.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","netfilter","nftables","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Firewall rules silently stop matching or wrong set entries get deleted","analyst_note":"Find the fixed kernel versions and CVSS score in the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98484 and confirm the trigger requires local root or CAP_NET_ADMIN.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed in the NVD entry (unknown in the sources provided).\n- Check whether nftables sets with catchall elements and timeouts are in use: `nft list ruleset | grep -i catchall`.","needs_analyst":true,"not_affected_if":["no-nftables-catchall-timeouts"],"who_is_affected":"Systems running Linux kernels with nf_tables and catchall set elements that use timeouts. Hosts that do not use nftables catchall elements with timeouts are unlikely to see the functional problem. The sources do not state a fixed version.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000678,"input_tokens":3680,"output_tokens":620,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-98484':15A,18A 'activ':104C,209C,263C 'active-next':208C 'addit':115C 'align':249C 'arbitrarili':187C 'away':168C 'backend':289C 'block':7A,139C 'candid':273C 'catchal':5A,37B,87C,95C,109C,121C,179C,203C,214C,292C 'code':47B 'collect':69B 'count':267C 'cve':13A,16A 'deactiv':204C,236C 'delet':12A,46B,61B,92C,195C,272C 'drift':129C,200C 'dump':51B,113C,135C,256C 'duplic':99C,270C 'eexist':151C 'elaps':176C 'elem':103C 'element':39B,88C,118C,122C,238C,260C 'enoent':248C 'entri':6A,64B,165C,211C,220C,228C 'excl':146C 'expir':3A,36B,86C,117C,126C,193C,219C,266C 'f':145C 'fail':149C,246C 'firewal':35B 'first':192C,207C 'follow':77C 'fresh':232C 'garbag':68B 'garbage-collect':67B 'gc':174C,223C,293C 'goe':167C 'hide':52B 'host':27B 'infrastructur':19B 'insert':10A,44B,90C,96C,142C,161C 'insert/.deactivate':290C 'instead':229C,244C 'interv':70B,175C 'invis':132C 'kernel':2A,22B,31B,75C 'line':285C 'linux':1A,21B,30B,74C 'linux-kernel':20B 'list':215C 'long':188C 'longer':242C 'look':97C 'lookup':110C,254C 'make':130C 'match':59B,184C 'may':181C 'netfilt':23B,82C 'netn':278C 'next':210C 'nf':33B,83C 'nft':93C,101C,107C,201C 'nftabl':4A,24B 'nlm':144C 'noth':162C 'one':233C 'pass':71B 'path':48B,114C,196C,295C 'pend':222C 'per':277C 'per-netn':276C 'pick':205C 'predic':128C,257C 're':9A,141C 're-insert':8A,140C 'report':157C 'request':148C,156C 'resolv':81C 'retir':225C 'rule':55B,180C 'see':243C 'self':26B 'self-host':25B 'set':38B,102C,108C,288C 'setelem':94C,202C 'show':197C 'silent':57B,160C,182C 'skip':85C,116C 'stale':164C,227C 'start':283C 'stay':40B 'still':138C,221C 'stop':58B,183C 'success':158C 'sync':294C 'tabl':34B,84C 'taken':280C 'time':189C 'timeout':125C 'timestamp':279C 'transact':282C 'tunabl':173C 'use':274C 'user':172C 'user-tun':171C 'userspac':50B,134C,240C 'visibl':41B 'vulner':78C 'walk':251C 'without':153C 'wrong':63B 'yet':136C","nicknames":[],"mitigations":[],"who_affected":"Systems running Linux kernels with nf_tables and catchall set elements that use timeouts. Hosts that do not use nftables catchall elements with timeouts are unlikely to see the functional problem. The sources do not state a fixed version.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:16:59+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98484","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98484","severity":null,"published_at":"2026-10-18T16:16:59+00:00","modified_at":"2026-10-21T13:21:31+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}