CVE-2026-98792

What it actually does

Race condition in Linux kernel netfilter flowtable where GC worker and hw offload stats handler can concurrently modify flow state, allowing nf_flow_offload_stats() to schedule work on a flow being removed.

Why it matters to the business

Networking instability or crashes on Linux systems handling high-volume flows with hardware offload, potentially disrupting services and requiring reboots.

How an attack unfolds

An attacker generates network traffic that triggers repeated flow creation and removal while stats retrieval is active, widening the race window between GC deletion and pending hw offload work to induce inconsistent state or crashes.

How to fix it

Update to a Linux kernel containing the fix that renames and reuses the pending status bit to serialize GC with hw offload operations; apply the revert of the prior reordering commit.

How to confirm the fix worked

Confirm the presence of the generalized NF_FLOW_PENDING bit and absence of the d644b23afe1e reordering in the running kernel source or via kernel version checks against upstream stable branches.

Typical attack path

1. Establish network flows that engage hardware offload in netfilter.
2. Induce rapid flow teardown via connection termination or timeout.
3. Concurrently trigger stats collection paths that schedule deferred work.
4. Exploit the window where GC removes the flow before pending work completes.

How to detect it

Review kernel logs for netfilter flowtable warnings, oops traces involving nf_flow_offload or GC workers, and unexpected flow state transitions around hardware offload paths.

What your security team should do

• Prioritize kernel upgrades on systems using netfilter flowtables with hardware offload.
• Monitor for kernel oops or networking-related panics in logs.
• Temporarily disable hardware offload on flowtables if immediate patching is not feasible.