CVE-2026-98622
Received
Received - Intake
Kernel Panic via act_ct Flow Offload Race Condition
Vulnerability report for CVE-2026-98622, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-18
Last updated on: 2026-10-18
Assigner: kernel.org
Description
Description
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure
flow_offload_alloc() returns NULL when the conntrack entry is dying
(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation
fails; both are expected under load and neither is a kernel bug. This
path runs from softirq on every committed packet, so with
panic_on_warn=1 an unprivileged user can panic the box just by racing
a conntrack flush against a `tc ... action ct commit` classifier.
Reproduced with a custom repro under QEMU: a small, fixed set of UDP
flows through `tc filter ... action ct commit` on lo, raced against
threads flooding bare ctnetlink CT_DELETE (flush) requests. Hits
WARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined
into tcf_ct_act() in this build) within ~15s on the unpatched kernel;
same setup is clean on the patched kernel. The fix itself is
behavior-preserving: both branches already did `goto err_alloc`
before and after, only the WARN is removed.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 64ff70b80fd403110b67dd9f7184a604fdb0da43 |
| Linux | Linux | 5.7 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
