{"id":"CVE-2026-98622","kind":"vulnerability","aliases":["CVE-2026-98622"],"related":[],"title":"Linux kernel: act_ct warning path can panic systems with panic_on_warn","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: don't WARN on benign flow_offload_alloc() failure\n\nflow_offload_alloc() returns NULL when the conntrack entry is dying\n(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation\nfails; both are expected under load and neither is a kernel bug. This\npath runs from softirq on every committed packet, so with\npanic_on_warn=1 an unprivileged user can panic the box just by racing\na conntrack flush against a `tc ... action ct commit` classifier.\n\nReproduced with a custom repro under QEMU: a small, fixed set of UDP\nflows through `tc filter ... action ct commit` on lo, raced against\nthreads flooding bare ctnetlink CT_DELETE (flush) requests. Hits\nWARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined\ninto tcf_ct_act() in this build) within ~15s on the unpatched kernel;\nsame setup is clean on the patched kernel. The fix itself is\nbehavior-preserving: both branches already did `goto err_alloc`\nbefore and after, only the WARN is removed.","summary":"A kernel warning fires in the traffic-classifier conntrack action when a flow allocation fails during a conntrack flush, which is expected under load. On systems with panic_on_warn=1, a local user racing a conntrack flush against a tc ct commit filter can crash the machine.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["conntrack","kernel","linux","runtime","traffic-control"],"not_affected_if":["default-config","no-tc-ct-action"],"how_to_check":"- `uname -r` and compare against the kernel release that contains the upstream commit removing the WARN in net/sched/act_ct.c\n- `sysctl kernel.panic_on_warn` (value `1` is the exposed setting)\n- `tc filter show dev <iface>` to see whether any filter uses `action ct commit`","fix":"- Update the Linux kernel to a release that includes the upstream fix removing the WARN from tcf_ct_flow_table_add() in net/sched/act_ct.c\n- Until patched, set `sysctl -w kernel.panic_on_warn=0` if it is `1`","status":"open","published_at":"2026-10-18T16:17:15+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:21:13+00:00","updated_at":"2026-10-25T05:21:13+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:21:13Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream fix removing the WARN from tcf_ct_flow_table_add() in net/sched/act_ct.c\n- Until patched, set `sysctl -w kernel.panic_on_warn=0` if it is `1`","reach":"local","title":"Linux kernel: act_ct warning path can panic systems with panic_on_warn","impact":"medium","summary":"A kernel warning fires in the traffic-classifier conntrack action when a flow allocation fails during a conntrack flush, which is expected under load. On systems with panic_on_warn=1, a local user racing a conntrack flush against a tc ct commit filter can crash the machine.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","traffic-control","conntrack"],"confidence":0.6,"needs_auth":"no","worst_case":"local unprivileged user crashes the kernel and takes the host down","analyst_note":"Sources give no exact fixed kernel version or stable commit id; check the NVD entry and the kernel.org stable mailing list for the fixed release numbers.","how_to_check":"- `uname -r` and compare against the kernel release that contains the upstream commit removing the WARN in net/sched/act_ct.c\n- `sysctl kernel.panic_on_warn` (value `1` is the exposed setting)\n- `tc filter show dev <iface>` to see whether any filter uses `action ct commit`","needs_analyst":true,"not_affected_if":["default-config","no-tc-ct-action"],"who_is_affected":"Systems that use tc with the act_ct action (ct commit in traffic classifiers) and run kernels that still contain the WARN. The panic needs kernel.panic_on_warn=1, which is not the default, so hosts with default settings only see a logged warning. Hosts that do not use tc ct actions are not affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000703,"input_tokens":3628,"output_tokens":680,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98622':16A,19A '1':58B,147C '15s':218C '437':203C 'act':3A,87C,213C 'action':37B,164C,185C 'add':208C 'alloc':41B,96C,100C,120C,244C 'alreadi':240C 'atom':119C 'bare':194C 'behavior':236C 'behavior-preserv':235C 'benign':93C 'box':154C 'branch':239C 'bug':132C 'build':216C 'classifi':35B,167C 'clean':226C 'commit':70B,140C,166C,187C 'conntrack':20B,36B,45B,64B,105C,113C,159C 'control':26B 'crash':73B 'ct':4A,69B,88C,165C,186C,196C,205C,212C 'ctnetlink':195C 'custom':171C 'cve':14A,17A 'delet':197C 'die':108C 'e.g':109C 'entri':106C 'err':243C 'everi':139C 'expect':49B,124C 'fail':42B,121C 'failur':97C 'filter':71B,184C 'fire':30B 'fix':177C,232C 'flood':193C 'flow':40B,94C,98C,181C,206C 'flush':46B,65B,114C,160C,198C 'follow':81C 'gfp':118C 'goto':242C 'hit':200C 'inlin':209C 'kernel':2A,21B,28B,79C,131C,222C,230C 'linux':1A,22B,78C 'lo':189C 'load':51B,126C 'local':60B 'machin':75B 'neither':128C 'net/sched':86C 'net/sched/act_ct.c':202C 'null':102C 'offload':95C,99C 'packet':141C 'panic':8A,11A,55B,144C,152C 'patch':229C 'path':6A,134C 'preserv':237C 'qemu':174C 'race':62B,110C,157C,190C 'remov':252C 'repro':172C 'reproduc':168C 'request':199C 'resolv':85C 'return':101C 'run':135C 'runtim':23B 'set':178C 'setup':224C 'small':176C 'softirq':137C 'system':9A,53B 'tabl':207C 'tc':68B,163C,183C 'tcf':204C,211C 'thread':192C 'traffic':25B,34B 'traffic-classifi':33B 'traffic-control':24B 'udp':180C 'unpatch':221C 'unprivileg':149C 'user':61B,150C 'vulner':82C 'warn':5A,13A,29B,57B,91C,146C,201C,250C 'within':217C","nicknames":[],"mitigations":[],"who_affected":"Systems that use tc with the act_ct action (ct commit in traffic classifiers) and run kernels that still contain the WARN. The panic needs kernel.panic_on_warn=1, which is not the default, so hosts with default settings only see a logged warning. Hosts that do not use tc ct actions are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:15+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98622","severity":null,"published_at":"2026-10-18T16:17:15+00:00","modified_at":"2026-10-19T10:19:26+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}