CVE-2026-98625
Received Received - Intake

Use-After-Free in Linux Kernel Netfilter Flowtable

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HW_DEAD after worker is done flow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler clears NF_FLOW_HW_PENDING. Once a flow is both HW_DYING and HW_DEAD, a concurrent garbage collection pass can remove it and schedule it for RCU freeing. The offload worker holds neither an RCU read lock nor a reference to the flow. If it is preempted after publishing HW_DEAD, the RCU callback can free the flow before the worker resumes and clears HW_PENDING, resulting in a use-after-free. Move HW_DEAD publication to the common worker epilogue after the pending bit is cleared, making it the final flow access by destroy work. Order all preceding flow accesses before publishing the bit that allows garbage collection to free the object.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98625
EUVD
EUVD-2026-103539

Affected Vendors & Products

Showing 9 associated CPEs
Vendor Product Version / Range
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 2c8897953f3b2ff5498f3f275708a742bfcdbc24
Linux Linux 5.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's netfilter flowtable subsystem. It occurs when the flow_offload_work_del() function sets a flag indicating a flow is dead before the worker clears another flag. This allows a concurrent garbage collection process to free the flow while the worker is still running, leading to a use-after-free condition when the worker resumes.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. It affects systems using the Linux kernel's netfilter flowtable feature, which is commonly used for network packet offloading.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Monitor kernel security advisories for updates addressing CVE-2026-98625.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart