Cloudanix VulnDB

CVE-2026-98625

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing bug in Linux network code can let attackers crash servers or potentially take them over by manipulating network traffic handling.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in netfilter flowtable allows flow_offload_work_del() to publish NF_FLOW_HW_DEAD before the worker clears NF_FLOW_HW_PENDING; a concurrent RCU garbage collection pass can then free the flow while the worker still holds a reference, causing use-after-free on resume.

Why it matters to the business

Kernel memory corruption or crashes in network data paths on Linux systems can produce denial of service, system instability, or potential privilege escalation; the issue affects any distribution using hardware flow offload with garbage collection.

How an attack unfolds

An attacker triggers repeated flow creation and deletion under load while racing garbage collection passes against the offload worker; once the freed flow is accessed after RCU reclamation, memory corruption occurs that can be leveraged for code execution or denial of service.

How to fix it

Apply the upstream kernel commit that moves NF_FLOW_HW_DEAD publication into the common worker epilogue after NF_FLOW_HW_PENDING is cleared; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Confirm the patch is present by inspecting the flow_offload_work_del and worker epilogue code paths; run kernel selftests for netfilter flowtable offload under concurrent deletion and GC load; verify no use-after-free reports in dmesg during stress testing.

Typical attack path

  1. Establish network flows that qualify for hardware offload
  2. Force repeated flow deletion and garbage collection under contention
  3. Win the race between HW_DEAD publication and pending-bit clearance
  4. Access the now-freed flow object from the resumed worker
  5. Exploit resulting use-after-free for corruption or control-flow hijack

How to detect it

Search kernel logs for oops, panic, or warning messages referencing netfilter, flowtable, or RCU use-after-free during periods of high flow churn; correlate with network flow creation/deletion activity.

What your security team should do

  • Prioritize patching kernel packages on any system exposing netfilter flowtable offload
  • Monitor upstream stable and distribution kernels for the backported fix
  • Temporarily disable hardware flow offload where feasible until patches are deployed
  • Increase logging of netfilter and RCU events on high-value systems for post-patch validation

The record

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HW_DEAD after worker is done flow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler clears NF_FLOW_HW_PENDING. Once a flow is both HW_DYING and HW_DEAD, a concurrent garbage collection pass can remove it and schedule it for RCU freeing. The offload worker holds neither an RCU read lock nor a reference to the flow. If it is preempted after publishing HW_DEAD, the RCU callback can free the flow before the worker resumes and clears HW_PENDING, resulting in a use-after-free. Move HW_DEAD publication to the common worker epilogue after the pending bit is cleared, making it the final flow access by destroy work. Order all preceding flow accesses before publishing the bit that allows garbage collection to free the object.

Affected packages

Ecosystem Package Introduced Fixed