CVE-2026-98484 Overview
CVE-2026-98484 is a logic flaw in the Linux kernel's netfilter subsystem, specifically in the nf_tables catchall element handling. The vulnerability stems from predicate drift between the insert, delete, lookup, and dump paths for catchall set elements. nft_setelem_catchall_insert() checks only whether an element is active, while nft_set_catchall_lookup() and the dump path additionally skip expired elements. Once a catchall element with a timeout expires, it becomes invisible to userspace while still blocking re-insertion, causing catchall rules to silently stop matching until garbage collection runs.
Critical Impact
Expired catchall nf_tables elements can block re-insertion and misdirect deletions, causing firewall rules to silently stop matching for arbitrarily long periods.
Affected Products
- Linux kernel netfilter / nf_tables subsystem
- Distributions shipping affected mainline kernels prior to the stable patches
- Any system relying on timeout-based catchall set elements for firewall policy
Discovery Timeline
- 2026-10-18 - CVE-2026-98484 published to the National Vulnerability Database (NVD)
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98484
Vulnerability Analysis
The flaw resides in how nf_tables evaluates catchall set elements across different code paths. The lookup and dump routines treat an element as present only when it is both active and not expired. The insert routine, nft_setelem_catchall_insert(), treats any active element as a duplicate without checking expiration. The delete routine, nft_setelem_catchall_deactivate(), picks the first active-next entry in the catchall list without filtering expired entries.
This inconsistency produces two observable failures. With NLM_F_EXCL, re-insertion of a catchall element whose timeout has already expired returns -EEXIST. Without the exclusive flag, the request reports success but silently inserts nothing. The stale entry persists until the user-tunable garbage collection interval elapses, so catchall-based rules can stop matching for an arbitrarily long window.
The delete path exhibits parallel drift. When userspace issues a delete, the kernel retires the stale, expired entry instead of the active element visible to userspace. Operators therefore deactivate elements they can no longer see rather than receiving -ENOENT.
Root Cause
The root cause is inconsistent application of the "active and not expired" predicate across the insert, delete, lookup, and dump walks over catchall elements. The insert and deactivate paths use a weaker predicate than the lookup and dump paths, producing divergent views of set state within the same transaction.
Attack Vector
The condition is triggered by legitimate nf_tables operations against sets containing catchall elements with timeouts. A local administrator or management agent updating firewall policy may unknowingly introduce silent policy drift. The published advisory does not identify a remote attack vector, and no exploit is listed as available.
The vulnerability mechanism is described in the upstream commit messages. See the kernel.org references for detailed patch descriptions rather than synthesized code.
Detection Methods for CVE-2026-98484
Indicators of Compromise
- nft set element replace or add operations returning -EEXIST for catchall entries that are not visible in nft list set output.
- Catchall firewall rules that stop matching expected traffic after an element's timeout expires, without corresponding configuration changes.
- Discrepancies between the catchall elements enumerated by nft list ruleset and those reported by audit tooling that queries the kernel directly.
Detection Strategies
- Compare running kernel version against the fixed commits (12cf803, 2f07da3, 4fb8b1c, 5e20b39, 70194dc) using configuration-management inventory.
- Monitor for nft userspace exit codes and netlink error returns indicating EEXIST or ENOENT on catchall operations.
- Instrument firewall policy pipelines to diff declared versus kernel-visible catchall elements after each push.
Monitoring Recommendations
- Collect kernel version and nf_tables ruleset telemetry from all Linux endpoints and servers into a centralized data store for drift analysis.
- Alert on firewall policy pushes that complete successfully but leave the kernel ruleset unchanged, which is the primary observable symptom.
- Track garbage collection interval tuning (nf_tables set GC) and treat long intervals as risk-increasing until patched.
How to Mitigate CVE-2026-98484
Immediate Actions Required
- Apply the stable kernel update containing the upstream fix commits referenced on kernel.org.
- Reduce the nf_tables set garbage collection interval on unpatched systems to shrink the window of silent rule failure.
- Audit all sets that use catchall elements with timeouts and verify that declared policy matches kernel state.
Patch Information
The fix aligns the insert and deactivate walks with the lookup and dump predicates. Only an element that is active and not expired counts as a duplicate or delete candidate, using the per-netns timestamp taken at transaction start. Patches are available in the following commits: Kernel Commit 12cf803, Kernel Commit 2f07da3, Kernel Commit 4fb8b1c, Kernel Commit 5e20b39, and Kernel Commit 70194dc.
Workarounds
- Avoid using timeouts on catchall nf_tables set elements until the kernel is patched.
- Replace catchall elements explicitly with delete-then-add sequences, verifying each operation against nft list set output.
- Schedule periodic ruleset reloads to force GC-driven cleanup of stale entries on unpatched hosts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
