CVE-2026-98320

What it actually does

Use-after-free in netfilter flowtable datapath caused by premature nf_ct_put() release of conntrack ext area before RCU grace period, allowing reference to freed or wrong conntrack object.

Why it matters to the business

Local attackers on affected Red Hat kernel systems can trigger kernel memory corruption leading to crashes, data leaks, or privilege escalation; 17 days post-disclosure with low but stable exploit probability increases urgency for timely patching of widely deployed kernels.

How an attack unfolds

An attacker with local access crafts network flows or conntrack manipulations that race with flow entry release, causing the flowtable datapath to dereference a freed conntrack after RCU grace period, resulting in UAF.

How to fix it

Upgrade kernel (redhat el8) to 4.18.0-553.176.1.el8_10 or kernel-rt (redhat el8) to 4.18.0-553.176.1.rt7.517.el8_10 per RHSA-2026:85774; ensure rcu_barrier is present on module exit after update.

How to confirm the fix worked

Verify installed kernel version matches or exceeds the fixed releases; confirm netfilter flowtable module loads without prior vulnerable symbols and test RCU grace period handling on module unload.

Typical attack path

1. Obtain local user access on affected kernel
2. Create or manipulate conntrack entries and flowtable rules to establish a race condition
3. Trigger flow release path while holding stale references
4. Exploit resulting UAF for memory corruption or code execution

How to detect it

Inspect kernel logs for netfilter flowtable UAF warnings, RCU-related stalls, or oops involving nf_conntrack and flow entries; correlate with unusual local network configuration changes or flowtable rule additions.

What your security team should do

• Apply the specified kernel updates immediately on all Red Hat EL8 systems
• Prioritize production workloads handling network flows
• Monitor for local privilege escalation attempts post-patch
• Review and restrict local user network capabilities where feasible