CVE-2026-98320
Received Received - Intake

Linux Kernel Netfilter Flowtable Use-After-Free

Publication date: 2026-10-06

Last updated on: 2026-10-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period. Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-06
Last Modified
2026-10-06
Generated
2026-10-06
AI Q&A
2026-10-06
EPSS Evaluated
N/A
NVD
CVE-2026-98320
EUVD
EUVD-2026-93305

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 0ff90b6c20340e57616a51ae1a1bf18156d6638a
Linux Linux 4.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the netfilter flowtable. The problem occurs when nf_ct_put() releases the connection tracking extension area too early, potentially allowing the wrong conntrack to be referenced in the flowtable datapath. The fix ensures a reference is held on the conntrack until the flow is fully released after an RCU grace period.

Impact Analysis

This could lead to memory corruption, crashes, or unexpected behavior in network traffic handling. Systems using affected Linux kernel versions with netfilter flowtable enabled may experience instability or security issues due to incorrect conntrack references.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the flowtable reference issue. Monitor network traffic for unusual patterns that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98320. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart