{"id":"CVE-2026-98851","kind":"vulnerability","aliases":["CVE-2026-98851"],"related":[],"title":"Linux kernel: failed nftables flow offload rule leaks flowtable reference","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nft_flow_offload: drop flowtable reference on init error path\n\nnft_flow_offload_init() bumps the flowtable use count with\nnft_use_inc() before calling nf_ct_netns_get().  When the latter\nfails, the error is returned as-is and the reference is leaked.\n\nThe upper layers do not balance it either: nf_tables_newexpr()\nclears expr->ops when the expression init callback fails, so the\nnft_expr_more() iteration in nft_rule_expr_deactivate() and\nnf_tables_rule_destroy() stops right before the failed expression\nand its ->destroy callback, which would drop the reference, never\nruns.\n\nEach failed rule addition therefore leaks one flowtable reference\nand the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE\nkeeps reporting -EBUSY even though no rule references it.\n\nSave the nf_ct_netns_get() return value and undo the nft_use_inc()\nwhen it fails, restoring the inc/dec pairing within\nnft_flow_offload_init() itself.","summary":"When adding an nftables flow offload rule fails, the kernel leaks a flowtable reference on each failed attempt. The leaked reference stops the flowtable from being deleted, so NFT_MSG_DELFLOWTABLE keeps returning -EBUSY.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","nftables","runtime","self-hosted"],"not_affected_if":["no-nftables-flowtables"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:02+00:00","updated_at":"2026-10-25T05:13:02+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:13:02Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: failed nftables flow offload rule leaks flowtable reference","impact":"low","summary":"When adding an nftables flow offload rule fails, the kernel leaks a flowtable reference on each failed attempt. The leaked reference stops the flowtable from being deleted, so NFT_MSG_DELFLOWTABLE keeps returning -EBUSY.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","nftables","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"Flowtable cannot be removed; resource leak and denial of service on netfilter.","analyst_note":"Find the fixed kernel versions and stable backport commit for this netfilter fix from the NVD entry or the kernel stable mailing list.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-nftables-flowtables"],"who_is_affected":"Systems running the Linux kernel with nftables flow offload flowtables configured. The sources do not say which kernel versions are affected or which configurations trigger the failed init path.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.000576,"input_tokens":3594,"output_tokens":434,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98851':13A,16A 'add':25B 'addit':170C 'as-i':106C 'attempt':41B 'balanc':119C 'bump':83C 'call':93C 'callback':132C,159C 'clear':125C 'count':87C 'ct':95C,199C 'cve':11A,14A 'deactiv':144C 'delet':50B 'delflowt':54B,186C 'destroy':149C,158C 'drop':72C,162C 'ebusi':57B,189C 'either':121C 'error':77C,103C 'even':190C 'expr':126C,137C,143C 'express':130C,155C 'fail':3A,31B,40B,101C,133C,154C,168C,212C 'flow':5A,28B,70C,80C,219C 'flowtabl':9A,36B,47B,73C,85C,174C,178C 'follow':63C 'get':97C,201C 'host':23B 'inc':91C,209C 'inc/dec':215C 'init':76C,82C,131C,221C 'iter':139C 'keep':55B,187C 'kernel':2A,17B,33B,61C 'latter':100C 'layer':116C 'leak':8A,34B,43B,113C,172C 'linux':1A,18B,60C 'longer':181C 'msg':53B,185C 'netfilt':68C 'netn':96C,200C 'never':165C 'newexpr':124C 'nf':94C,122C,146C,198C 'nft':52B,69C,79C,89C,136C,141C,184C,207C,218C 'nftabl':4A,19B,27B 'offload':6A,29B,71C,81C,220C 'one':173C 'op':127C 'pair':216C 'path':78C 'refer':10A,37B,44B,74C,111C,164C,175C,194C 'remov':183C 'report':188C 'resolv':67C 'restor':213C 'return':56B,105C,202C 'right':151C 'rule':7A,30B,142C,148C,169C,193C 'run':166C 'runtim':20B 'save':196C 'self':22B 'self-host':21B 'stop':45B,150C 'tabl':123C,147C 'therefor':171C 'though':191C 'undo':205C 'upper':115C 'use':86C,90C,208C 'valu':203C 'vulner':64C 'within':217C 'would':161C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with nftables flow offload flowtables configured. The sources do not say which kernel versions are affected or which configurations trigger the failed init path.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98851","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98851","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}