CVE-2026-98792
Received Received - Intake

Flowtable Pending Status Race Condition in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf_flow_offload_stats() can schedule work to retrieve stats while the flow is being removed by GC. And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions. Revert the reordering done in commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") to prevent a race between GC and hw offload handler.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-19
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98792
EUVD
EUVD-2026-103877

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 5.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a race condition in the netfilter flowtable's garbage collection (GC) and hardware offload handling. The issue stems from the use of a pending status bit (NF_FLOW_PENDING) to prevent premature flow removal while hardware offload operations are still in progress. A flaw in the current implementation allows the GC worker to remove flows while hardware offload statistics retrieval is scheduled, creating a potential race condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter flowtable functionality. Detection requires checking kernel logs for flowtable-related errors or race conditions during hardware offload operations. Monitor logs for messages about NF_FLOW_PENDING status or GC worker conflicts.

Impact Analysis

This vulnerability could lead to network traffic disruption or incorrect flow handling if the race condition occurs. Systems relying on hardware offload for network flows might experience packet drops, misrouted traffic, or performance degradation due to premature flow removal by the GC worker.

Compliance Impact

This vulnerability is specific to the Linux kernel's netfilter flowtable functionality and does not directly impact compliance with standards like GDPR or HIPAA. It involves a race condition in hardware offload handling, which could affect network traffic processing but does not inherently relate to data privacy or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If patches are unavailable, consider disabling flowtable hardware offload temporarily until updates are applied. Monitor kernel logs for flowtable-related errors as a sign of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98792. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart