CVE-2026-98320 (GCVE-0-2026-98320)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50
VLAI
Title
netfilter: flowtable: hold reference on ct until flow is released
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period. Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 54/100 over 6633 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 93ff1594be1aad4da364462dd8db050ebcfda2de (git)
Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < eed6997e8dc40593a539fcc722e7ed51b18db86c (git)
Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 61c6688be282277c6e91ab286a7acd0ae8681ac6 (git)
Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < a43cd2b67b91e943273c913237a7a88c50cdcfbc (git)
Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 8274cdc5f9c57e17ed77fc4ba76212536c840f25 (git)
Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 12c1ac230f4ca16e0017b62a963ab75e0b48074f (git)
Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < d9e6175a3ee48209ee65f294fc567b4e16b29b74 (git)
Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.16
Unaffected: 0 , < 4.16 (semver)
Unaffected: 5.10.271 , ≤ 5.10.* (semver)
Unaffected: 5.15.222 , ≤ 5.15.* (semver)
Unaffected: 6.1.189 , ≤ 6.1.* (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.54 , ≤ 6.18.* (semver)
Unaffected: 7.2.8 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "93ff1594be1aad4da364462dd8db050ebcfda2de",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "eed6997e8dc40593a539fcc722e7ed51b18db86c",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "61c6688be282277c6e91ab286a7acd0ae8681ac6",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "a43cd2b67b91e943273c913237a7a88c50cdcfbc",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "8274cdc5f9c57e17ed77fc4ba76212536c840f25",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "12c1ac230f4ca16e0017b62a963ab75e0b48074f",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "d9e6175a3ee48209ee65f294fc567b4e16b29b74",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct-\u003eext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The freed ct is reached from nf_flow_offload_forward() (nf_ct_acct_update/flow_offload_teardown on flow-\u003ect) but freeing it needs the conntrack killed (nf_ct_is_dying) and flow_offload_del() run; a remote peer only supplies forwarded packets and cannot kill an offloaded ct, so the full trigger needs local nftables/ctnetlink access.\nAC:L - The attacker drives every side of the race: they flood packets through their own flowtable, delete the ct via ctnetlink, and force nf_flow_offload_gc_step()-\u003eflow_offload_del() at once by downing the veth (nf_flow_table_gc_cleanup flush_delayed_work). The window is narrow but can be retried indefinitely.\nPR:L - Creating the nftables flowtable, adding veth forwarding and sending IPCTNL_MSG_CT_DELETE need only CAP_NET_ADMIN in a network namespace, which an unprivileged user gets via unshare -Urn.\nUI:N - No victim action is needed; the attacker sets up the flowtable, the traffic and the conntrack/flow teardown entirely within their own namespace.\nS:U - Memory corruption in the host kernel\u0027s netfilter flowtable/conntrack objects yields kernel privilege escalation within the same authority; no VM or hardware boundary is crossed.\nC:H - flow_offload_free() dropped the ct reference before the RCU grace period, so in-flight readers dereference ct-\u003eext after nf_conntrack_free() has kfree\u0027d it, or a recycled SLAB_TYPESAFE_BY_RCU nf_conn now owned by another connection - a use-after-free that can be groomed to leak kernel memory.\nI:H - The stale reader writes freed or reused memory: nf_ct_acct_add() does atomic64_add into the freed ct-\u003eext counters, and flow_offload_teardown()/flow_offload_fixup_ct() modify status/timeout of a recycled conntrack, giving heap-corruption primitives.\nA:H - The use-after-free on ct-\u003eext and recycled nf_conn objects in the forwarding softirq can corrupt the slab and crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:50:01.858Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de"
        },
        {
          "url": "https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c"
        },
        {
          "url": "https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25"
        },
        {
          "url": "https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74"
        },
        {
          "url": "https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d"
        }
      ],
      "title": "netfilter: flowtable: hold reference on ct until flow is released",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98320",
    "datePublished": "2026-10-06T08:46:14.757Z",
    "dateReserved": "2026-09-25T10:25:14.340Z",
    "dateUpdated": "2026-10-07T06:50:01.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98320",
      "date": "2026-10-08",
      "epss": "0.00138",
      "percentile": "0.02771"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_flow_table_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "93ff1594be1aad4da364462dd8db050ebcfda2de",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "eed6997e8dc40593a539fcc722e7ed51b18db86c",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "61c6688be282277c6e91ab286a7acd0ae8681ac6",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a43cd2b67b91e943273c913237a7a88c50cdcfbc",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8274cdc5f9c57e17ed77fc4ba76212536c840f25",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "12c1ac230f4ca16e0017b62a963ab75e0b48074f",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d9e6175a3ee48209ee65f294fc567b4e16b29b74",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d",
                    "status": "affected",
                    "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_flow_table_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.16"
                  },
                  {
                    "lessThan": "4.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.54",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc4",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct-\u003eext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away."
          }
        ],
        "id": "CVE-2026-98320",
        "lastModified": "2026-10-07T07:17:08.847",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-06T09:18:23.957",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-08T16:47:39Z",
      "cve": "CVE-2026-98320",
      "id": "CVE-2026-98320",
      "initial_release_date": "2026-10-08T16:47:39Z",
      "product_status:known_affected": "208",
      "product_status:known_not_affected": "137",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98320",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-98320.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.