{"id":"CVE-2026-98792","kind":"vulnerability","aliases":["CVE-2026-98792"],"related":[],"title":"Linux kernel netfilter flowtable: race between garbage collection and stats offload","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: generalize pending status bit\n\nRename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the\nflowtable GC worker until pending hw offload work has been completed.\n\nApparently, nf_flow_offload_stats() can schedule work to retrieve stats\nwhile the flow is being removed by GC.\n\nAnd this bit can also be used in a follow up patch to disable GC until\nthe flow has been fully added in both directions.\n\nRevert the reordering done in commit d644b23afe1e (\"netfilter:\nflowtable: publish HW_DEAD after worker is done\") to prevent a race\nbetween GC and hw offload handler.","summary":"A race in the Linux kernel's netfilter flowtable code lets the garbage collector remove a flow while a hardware offload stats worker is still pending for it. The sources do not describe a confirmed attacker outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["firewalls","infrastructure","linux-kernel","netfilter","routers"],"not_affected_if":["no-flowtable-offload"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-18T16:17:33+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:12+00:00","updated_at":"2026-10-25T05:15:12+00:00","category":"infrastructure","confidence":0.35,"triage":{"at":"2026-10-25T05:15:12Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"unknown","title":"Linux kernel netfilter flowtable: race between garbage collection and stats offload","impact":"low","summary":"A race in the Linux kernel's netfilter flowtable code lets the garbage collector remove a flow while a hardware offload stats worker is still pending for it. The sources do not describe a confirmed attacker outcome.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","netfilter","routers","firewalls"],"confidence":0.35,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected versions, the security impact and any fixed stable releases.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-flowtable-offload"],"who_is_affected":"Systems running a Linux kernel with netfilter flowtable offload, typically routers, firewalls and gateways that use flow offloading. Hosts that do not use nftables flowtables are unlikely to be affected. The sources do not state the affected kernel versions.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000558,"input_tokens":3460,"output_tokens":424,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':13A,16A '-98792':14A,17A 'add':144C 'also':127C 'appar':104C 'attack':60B 'bit':77C,125C 'code':34B 'collect':8A 'collector':38B 'commit':153C 'complet':103C 'confirm':59B 'cve':12A,15A 'd644b23afe1e':154C 'dead':159C 'describ':57B 'direct':147C 'disabl':136C 'done':151C,163C 'firewal':18B 'flow':41B,80C,85C,106C,117C,140C 'flowtabl':4A,33B,73C,93C,156C 'follow':67C,132C 'fulli':143C 'garbag':7A,37B 'gc':94C,122C,137C,169C 'general':74C 'handler':173C 'hardwar':44B 'hw':81C,98C,158C,171C 'infrastructur':19B 'inhibit':91C 'kernel':2A,22B,30B,65C 'let':35B 'linux':1A,21B,29B,64C 'linux-kernel':20B 'netfilt':3A,23B,32B,72C,155C 'nf':79C,84C,105C 'offload':11A,45B,99C,107C,172C 'outcom':61B 'patch':134C 'pend':50B,75C,82C,86C,97C 'prevent':165C 'publish':157C 'race':5A,26B,167C 'remov':39B,120C 'renam':78C 'reorder':150C 'resolv':71C 'retriev':113C 'revert':148C 'router':24B 'schedul':110C 'sourc':54B 'stat':10A,46B,108C,114C 'status':76C 'still':49B 'use':88C,129C 'vulner':68C 'work':100C,111C 'worker':47B,95C,161C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with netfilter flowtable offload, typically routers, firewalls and gateways that use flow offloading. Hosts that do not use nftables flowtables are unlikely to be affected. The sources do not state the affected kernel versions.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98792","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98792","severity":null,"published_at":"2026-10-18T16:17:33+00:00","modified_at":"2026-10-21T13:21:46+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}