CVE-2026-98622

Received Received - Intake

Kernel Panic via act_ct Flow Offload Race Condition

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure flow_offload_alloc() returns NULL when the conntrack entry is dying (e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation fails; both are expected under load and neither is a kernel bug. This path runs from softirq on every committed packet, so with panic_on_warn=1 an unprivileged user can panic the box just by racing a conntrack flush against a `tc ... action ct commit` classifier. Reproduced with a custom repro under QEMU: a small, fixed set of UDP flows through `tc filter ... action ct commit` on lo, raced against threads flooding bare ctnetlink CT_DELETE (flush) requests. Hits WARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined into tcf_ct_act() in this build) within ~15s on the unpatched kernel; same setup is clean on the patched kernel. The fix itself is behavior-preserving: both branches already did `goto err_alloc` before and after, only the WARN is removed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98622

EUVD

EUVD-2026-103667

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	64ff70b80fd403110b67dd9f7184a604fdb0da43
Linux	Linux	5.7

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where a warning message is triggered incorrectly during normal operations. When flow_offload_alloc() fails due to expected conditions like a conntrack entry dying or memory allocation limits, the kernel logs a warning. This warning can cause a system panic if panic_on_warn is enabled, allowing an unprivileged user to crash the system by exploiting this race condition.

Detection Guidance

This vulnerability may trigger a kernel warning when flow_offload_alloc() fails under specific conditions like conntrack flush races. Monitor kernel logs for warnings from net/sched/act_ct.c, particularly around tcf_ct_flow_table_add or tcf_ct_act. Check for repeated WARN messages during high-load scenarios with tc filters using action ct commit.

Impact Analysis

An attacker could exploit this to crash the system by causing a kernel panic. This leads to denial of service, disrupting services and potentially causing data loss. Systems with panic_on_warn enabled are particularly vulnerable, as the warning triggers an immediate system halt.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it is a kernel-level denial-of-service issue in Linux. However, if exploited, it could lead to system unavailability, which may impact data processing operations subject to these regulations.

Mitigation Strategies

Apply the kernel patch that removes the WARN in net/sched/act_ct.c. If patching is not immediately possible, disable panic_on_warn or adjust kernel parameters to avoid kernel panics on warnings. Monitor system logs for signs of exploitation attempts during high-load conntrack operations.

Hi! I’m here to help you understand CVE-2026-98622. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70