CVE-2026-98851
Received Received - Intake

Flowtable Reference Leak in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: drop flowtable reference on init error path nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_netns_get(). When the latter fails, the error is returned as-is and the reference is leaked. The upper layers do not balance it either: nf_tables_newexpr() clears expr->ops when the expression init callback fails, so the nft_expr_more() iteration in nft_rule_expr_deactivate() and nf_tables_rule_destroy() stops right before the failed expression and its ->destroy callback, which would drop the reference, never runs. Each failed rule addition therefore leaks one flowtable reference and the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE keeps reporting -EBUSY even though no rule references it. Save the nf_ct_netns_get() return value and undo the nft_use_inc() when it fails, restoring the inc/dec pairing within nft_flow_offload_init() itself.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98851
EUVD
EUVD-2026-103791

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
Linux Linux a3c90f7a2323b331ae816d5b0633e68148e25d04
Linux Linux a3c90f7a2323b331ae816d5b0633e68148e25d04
Linux Linux a3c90f7a2323b331ae816d5b0633e68148e25d04
Linux Linux a3c90f7a2323b331ae816d5b0633e68148e25d04
Linux Linux 4.16

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a reference leak in the netfilter flowtable subsystem. When initializing a flowtable offload, the function nft_flow_offload_init() increments the flowtable's use count but fails to decrement it if a subsequent operation, nf_ct_netns_get(), fails. This leaves the reference count elevated, preventing the flowtable from being removed even when no rules reference it.

Detection Guidance

This vulnerability involves a reference leak in the Linux kernel's netfilter flowtable. Detection requires checking for flowtables that cannot be removed due to leaked references. Use commands like 'nft list flowtables' to inspect flowtables and verify if any show -EBUSY errors when deletion is attempted.

Impact Analysis

This vulnerability can cause flowtables to become permanently stuck in memory, consuming system resources. It may lead to performance degradation or denial of service if many flowtables are leaked. Administrators may be unable to remove flowtables via normal commands due to persistent -EBUSY errors.

Mitigation Strategies

Apply the latest Linux kernel patches to resolve the reference leak in nft_flow_offload_init. If patching is not immediately possible, avoid creating new flowtable rules until the fix is applied to prevent further reference leaks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98851. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart