---
id: "CVE-2026-98622"
kind: "vulnerability"
aliases: ["CVE-2026-98622"]
title: "Linux kernel: act_ct warning path can panic systems with panic_on_warn"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["conntrack", "kernel", "linux", "runtime", "traffic-control"]
not_affected_if: ["default-config", "no-tc-ct-action"]
published_at: "2026-10-18T16:17:15+00:00"
first_seen_at: "2026-10-23T21:57:16+00:00"
updated_at: "2026-10-25T05:21:13+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98622", "first_seen_at": "2026-10-23T21:57:16+00:00"}]
---

# Linux kernel: act_ct warning path can panic systems with panic_on_warn

A kernel warning fires in the traffic-classifier conntrack action when a flow allocation fails during a conntrack flush, which is expected under load. On systems with panic_on_warn=1, a local user racing a conntrack flush against a tc ct commit filter can crash the machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the kernel release that contains the upstream commit removing the WARN in net/sched/act_ct.c
- `sysctl kernel.panic_on_warn` (value `1` is the exposed setting)
- `tc filter show dev <iface>` to see whether any filter uses `action ct commit`

## Fix

- Update the Linux kernel to a release that includes the upstream fix removing the WARN from tcf_ct_flow_table_add() in net/sched/act_ct.c
- Until patched, set `sysctl -w kernel.panic_on_warn=0` if it is `1`

## Timeline

- 2026-10-23T21:57:16+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98622

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

flow_offload_alloc() returns NULL when the conntrack entry is dying
(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation
fails; both are expected under load and neither is a kernel bug. This
path runs from softirq on every committed packet, so with
panic_on_warn=1 an unprivileged user can panic the box just by racing
a conntrack flush against a `tc ... action ct commit` classifier.

Reproduced with a custom repro under QEMU: a small, fixed set of UDP
flows through `tc filter ... action ct commit` on lo, raced against
threads flooding bare ctnetlink CT_DELETE (flush) requests. Hits
WARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined
into tcf_ct_act() in this build) within ~15s on the unpatched kernel;
same setup is clean on the patched kernel. The fix itself is
behavior-preserving: both branches already did `goto err_alloc`
before and after, only the WARN is removed.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_