CVE-2026-98320

netfilter: flowtable: hold reference on ct until flow is released

State: Published
Severity: 7.8 High
Published: Oct 6, 2026
Updated: Oct 19, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: hold reference on ct until flow is released

nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period.

Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 93ff1594be1aad4da364462dd8db050ebcfda2deAffected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before eed6997e8dc40593a539fcc722e7ed51b18db86cAffected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 61c6688be282277c6e91ab286a7acd0ae8681ac6Affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before a43cd2b67b91e943273c913237a7a88c50cdcfbcAffected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 8274cdc5f9c57e17ed77fc4ba76212536c840f25Affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 12c1ac230f4ca16e0017b62a963ab75e0b48074fAffected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before d9e6175a3ee48209ee65f294fc567b4e16b29b74Affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0dAffected
LinuxLinux	4.16Affected before 4.16Not affected 5.10.271 through 5.10.Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.54 through 6.18.Not affected 7.2.8 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 93ff1594be1aad4da364462dd8db050ebcfda2deAffected
0ff90b6c20340e57616a51ae1a1bf18156d6638a to before eed6997e8dc40593a539fcc722e7ed51b18db86cAffected
0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 61c6688be282277c6e91ab286a7acd0ae8681ac6Affected
0ff90b6c20340e57616a51ae1a1bf18156d6638a to before a43cd2b67b91e943273c913237a7a88c50cdcfbcAffected
0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 8274cdc5f9c57e17ed77fc4ba76212536c840f25Affected
0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 12c1ac230f4ca16e0017b62a963ab75e0b48074fAffected
0ff90b6c20340e57616a51ae1a1bf18156d6638a to before d9e6175a3ee48209ee65f294fc567b4e16b29b74Affected
0ff90b6c20340e57616a51ae1a1bf18156d6638a to before e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0dAffected

LinuxLinux

4.16Affected
before 4.16Not affected
5.10.271 through 5.10.*Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.54 through 6.18.*Not affected
7.2.8 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.