CVE-2026-98851

What it actually does

Reference leak in nft_flow_offload_init when nf_ct_netns_get fails after nft_use_inc, preventing flowtable deletion via NFT_MSG_DELFLOWTABLE returning EBUSY.

Why it matters to the business

Network administrators lose the ability to remove flowtables after failed rule additions, potentially causing resource leaks and blocking cleanup of network configurations in high-volume environments.

How an attack unfolds

An attacker with sufficient privileges to add nftables rules repeatedly triggers initialization errors in the flow offload expression to accumulate leaked references, rendering affected flowtables undeletable.

How to fix it

Update the Linux kernel to a version containing the fix that restores the use-count pairing inside nft_flow_offload_init by undoing the increment on nf_ct_netns_get failure.

How to confirm the fix worked

Confirm the kernel source contains the corrected nft_flow_offload_init that saves the nf_ct_netns_get result and calls nft_use_dec on error; test that failed rule additions no longer prevent subsequent flowtable deletion.

Typical attack path

1. Gain ability to submit nftables expressions via netlink
2. Construct a rule using nft_flow_offload that causes nf_ct_netns_get to fail after the use count increment
3. Repeat failed rule additions to leak references
4. Attempt flowtable deletion to observe persistent EBUSY errors

How to detect it

Review kernel logs and nftables netlink audit records for repeated failures during rule addition that reference flow offload initialization; look for persistent EBUSY errors on flowtable deletion attempts.

What your security team should do

• Prioritize kernel updates for systems using nftables flow offload expressions
• Monitor nftables rule addition logs for repeated failures involving flow offload
• Audit nftables configurations to minimize use of flow offload where possible until patched