Live › vulnerability › CVE-2026-98792
Go to dashboardA race in the Linux kernel's netfilter flowtable code lets the garbage collector remove a flow while a hardware offload stats worker is still pending for it. The sources do not describe a confirmed attacker outcome.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with netfilter flowtable offload, typically routers, firewalls and gateways that use flow offloading. Hosts that do not use nftables flowtables are unlikely to be affected. The sources do not state the affected kernel versions.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: generalize pending status bit
Rename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed.
Apparently, nf_flow_offload_stats() can schedule work to retrieve stats while the flow is being removed by GC.
And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions.
Revert the reordering done in commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") to prevent a race between GC and hw offload handler.
This page as .md · .json · in your agent: get_signal("CVE-2026-98792")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.