CVE-2026-98622: Linux Kernel act_ct DOS Vulnerability

CVE-2026-98622 Overview

CVE-2026-98622 is a Linux kernel denial-of-service issue in the net/sched traffic control subsystem, specifically in the act_ct connection tracking action. The kernel issued a WARN when flow_offload_alloc() returned NULL, even though that return value is a benign condition that occurs during normal connection tracking races or atomic allocation pressure. On systems configured with panic_on_warn=1, an unprivileged local user can trigger a kernel panic by racing conntrack flush operations against a tc action ct commit classifier.

Critical Impact

Unprivileged local users can panic kernels running with panic_on_warn=1 by racing conntrack flushes against tc ... action ct commit traffic, producing a reliable denial-of-service condition.

Affected Products

• Linux kernel builds containing the act_ct action with the pre-patch tcf_ct_flow_table_add() code path
• Distributions and stable trees receiving backports via the referenced kernel commits
• Hardened kernels configured with panic_on_warn=1 where the DoS impact is most pronounced

Discovery Timeline

• 2026-10-18 - CVE-2026-98622 published to NVD
• 2026-10-19 - Last updated in NVD database

Technical Details for CVE-2026-98622

Vulnerability Analysis

The vulnerability resides in net/sched/act_ct.c at the tcf_ct_flow_table_add() function, which is inlined into tcf_ct_act(). The code path executes from softirq context on every packet committed by a tc action ct commit classifier. When the function calls flow_offload_alloc(), two legitimate conditions can produce a NULL return: a dying conntrack entry raced with a conntrack flush, and an exhausted GFP_ATOMIC allocation under memory pressure.

Both outcomes are expected under load. The pre-patch code emitted a WARNING at net/sched/act_ct.c:437 before taking the goto err_alloc branch. The warning did not reflect a kernel defect, but it interacted dangerously with the common panic_on_warn=1 sysctl used by hardened and crash-reporting deployments.

The fix removes the WARN while preserving the existing control flow. Both allocation-failure branches continue to execute goto err_alloc as before, so no functional behavior changes beyond suppression of the spurious warning.

Root Cause

The root cause is a misplaced invariant assertion. flow_offload_alloc() has multiple legitimate reasons to return NULL, including a race with ctnetlinkCT_DELETE requests that mark the conntrack entry as dying, and transient GFP_ATOMIC failures. Treating either of these as a bug via WARN was incorrect, and the softirq execution context made the warning reachable on every packet.

Attack Vector

An unprivileged local user generates a small set of UDP flows traversing an interface configured with tc filter ... action ct commit. In parallel, the attacker floods bare ctnetlinkCT_DELETE requests to flush connection tracking entries. The resulting race produces a dying-conntrack return from flow_offload_alloc() within approximately 15 seconds under the reproducer described in the kernel commit message. On kernels with panic_on_warn=1, the WARN converts into a full kernel panic. The vulnerability requires local access and does not provide code execution or privilege escalation.

The vulnerability mechanism is documented in the upstream fix at Kernel Commit 00734f36.

Detection Methods for CVE-2026-98622

Indicators of Compromise

• Kernel log entries containing WARNING: net/sched/act_ct.c:437 or tcf_ct_flow_table_add on unpatched kernels
• Unexpected kernel panics on hosts configured with panic_on_warn=1 that coincide with heavy tc action ct commit traffic
• Elevated ctnetlinkCT_DELETE message volume concurrent with packet forwarding workloads

Detection Strategies

• Monitor dmesg and /var/log/kern.log for the act_ct.c:437 warning signature, which indicates reachability of the vulnerable path.
• Audit active tc configurations with tc -s filter show to identify interfaces using the action ct commit classifier.
• Alert on sudden spikes in conntrack flush activity via conntrack -E -e DESTROY or equivalent netlink monitoring.

Monitoring Recommendations

• Track kernel panic events and correlate with traffic control and conntrack subsystem metrics.
• Review the panic_on_warn sysctl setting across the fleet with sysctl kernel.panic_on_warn and inventory hosts where it is enabled.
• Collect kernel version data to confirm which systems still carry the vulnerable tcf_ct_flow_table_add() code.

How to Mitigate CVE-2026-98622

Immediate Actions Required

• Apply the upstream fix or a distribution backport containing the commits listed in the technical references.
• On hosts that cannot immediately patch, consider temporarily setting kernel.panic_on_warn=0 to prevent the DoS, accepting the trade-off against hardening policy.
• Restrict unprivileged access to CAP_NET_ADMIN-adjacent capabilities and audit workloads that permit arbitrary conntrack manipulation.

Patch Information

The fix removes the WARN call in tcf_ct_flow_table_add() while retaining the goto err_alloc branches. Stable backports are available in the following kernel commits: 00734f36, 424ba52c, 47abe7a5, 65078723, af475f59, d512c484, d805560a, and e8fcf3f0.

Workarounds

• Disable panic_on_warn on systems where availability outweighs the hardening benefit until the patch is deployed.
• Remove or avoid tc action ct commit classifiers on interfaces exposed to untrusted local workloads where feasible.
• Rate-limit or restrict unprivileged access to ctnetlink flush operations through namespacing and capability controls.

# Verify the panic_on_warn setting that amplifies this DoS
sysctl kernel.panic_on_warn

# Temporarily disable panic_on_warn as a workaround (reduces hardening)
sysctl -w kernel.panic_on_warn=0

# Enumerate interfaces using the vulnerable classifier
tc filter show dev <iface> | grep -i 'action ct'