Live › vulnerability › CVE-2026-98851
Go to dashboardWhen adding an nftables flow offload rule fails, the kernel leaks a flowtable reference on each failed attempt. The leaked reference stops the flowtable from being deleted, so NFT_MSG_DELFLOWTABLE keeps returning -EBUSY.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running the Linux kernel with nftables flow offload flowtables configured. The sources do not say which kernel versions are affected or which configurations trigger the failed init path.
No product ranges from the sources yet.
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nft_flow_offload: drop flowtable reference on init error path
nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_netns_get(). When the latter fails, the error is returned as-is and the reference is leaked.
The upper layers do not balance it either: nf_tables_newexpr() clears expr->ops when the expression init callback fails, so the nft_expr_more() iteration in nft_rule_expr_deactivate() and nf_tables_rule_destroy() stops right before the failed expression and its ->destroy callback, which would drop the reference, never runs.
Each failed rule addition therefore leaks one flowtable reference and the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE keeps reporting -EBUSY even though no rule references it.
Save the nf_ct_netns_get() return value and undo the nft_use_inc() when it fails, restoring the inc/dec pairing within nft_flow_offload_init() itself.
This page as .md · .json · in your agent: get_signal("CVE-2026-98851")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.