CVE-2026-98792: Linux Kernel Race Condition Vulnerability

CVE-2026-98792 Overview

CVE-2026-98792 is a race condition in the Linux kernel's netfilter flowtable subsystem. The flaw occurs between the flowtable garbage collector (GC) worker and pending hardware offload operations. Specifically, nf_flow_offload_stats() can schedule work to retrieve statistics while a flow is concurrently being removed by GC. The upstream fix generalizes the pending status bit by renaming NF_FLOW_HW_PENDING to NF_FLOW_PENDING and uses it to inhibit the GC worker until pending hardware offload work completes. The patch also reverts the reordering introduced by commit d644b23afe1e to prevent the GC and hardware offload handler from racing.

Critical Impact
Concurrent execution of the flowtable GC worker and pending hardware offload stats work can trigger a race, potentially leading to use-after-free or inconsistent flowtable state in the kernel.

Affected Products

Linux kernel netfilter flowtable subsystem
Upstream Linux kernel branches prior to the fixing commits
Distributions shipping stable kernels that have not yet backported the fix

Discovery Timeline

2026-10-18 - CVE-2026-98792 published to NVD
2026-10-21 - Last updated in NVD database

Technical Details for CVE-2026-98792

Vulnerability Analysis

The Linux kernel netfilter flowtable accelerates connection tracking by caching flows and optionally offloading them to hardware. A dedicated garbage collector worker periodically scans the flowtable to remove stale or dead flows. In parallel, nf_flow_offload_stats() can schedule asynchronous work to retrieve statistics from offloaded flows.

Before this fix, no barrier prevented the GC worker from retiring a flow while hardware offload stats work was still pending against the same entry. The reordering introduced by commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") exposed this window, allowing GC and the hardware offload handler to operate on the same flow concurrently.

Root Cause

The root cause is insufficient synchronization between flowtable lifecycle transitions and asynchronous hardware offload work queues. The existing NF_FLOW_HW_PENDING bit only covered hardware offload scheduling, not the broader set of pending operations that must complete before GC may release a flow. This gap creates a time-of-check to time-of-use (TOCTOU) condition between stats collection and flow teardown.

Attack Vector

The condition is triggered under normal network traffic conditions when hardware offload is enabled for the flowtable and stats collection is active. Reaching the race window typically requires local control over netfilter configuration or sustained traffic patterns that drive concurrent offload activity and GC passes. No remote authentication bypass or user-space code execution path is described in the advisory.

The upstream fix renames the pending bit to NF_FLOW_PENDING, extends its scope, and uses it to inhibit the GC worker until pending hardware offload work finishes. See the stable kernel commits for the exact code changes.

Detection Methods for CVE-2026-98792

Indicators of Compromise

Unexpected kernel oops or warnings referencing nf_flow_offload_stats, flow_offload_work_handler, or flowtable GC paths
Kernel crash dumps indicating use-after-free in net/netfilter/nf_flow_table_* modules
Sporadic connectivity disruptions on systems using hardware-offloaded flowtables under load

Detection Strategies

Audit running kernel versions against the fixing commits (4033e1a9, 4d52b72f, 7c549fb7, a2cac458, f7e292f3) across all Linux hosts
Monitor dmesg and journal logs for KASAN or lockdep reports touching nf_flow_table symbols
Correlate kernel instability events on hosts with nftables flowtable offload enabled

Monitoring Recommendations

Centralize kernel log collection and alert on crash signatures involving netfilter flowtable functions
Track kernel package versions across the fleet and flag hosts behind the patched baseline
Review nftables rulesets for flowtable definitions with offload flags to prioritize patching

How to Mitigate CVE-2026-98792

Immediate Actions Required

Inventory Linux systems running kernels with netfilter flowtable hardware offload enabled
Apply the vendor kernel update that includes the NF_FLOW_PENDING generalization patch
Reboot affected hosts after installing the updated kernel to load the fixed code

Patch Information

The fix is distributed across multiple stable kernel branches via the following commits: 4033e1a9, 4d52b72f, 7c549fb7, a2cac458, and f7e292f3. Install the kernel package from your distribution that incorporates these changes.

Workarounds

Disable hardware offload on nftables flowtables where the feature is not essential, removing the offload flag from the flowtable definition
Avoid enabling flow statistics collection on offloaded flowtables until the kernel is patched
Where possible, remove flowtable usage entirely on exposed hosts until the fixed kernel is deployed

bash

# Example: list nftables flowtables and inspect for offload flag
sudo nft list ruleset | grep -A5 'flowtable'

# Example: remove hardware offload from a flowtable definition
# Edit /etc/nftables.conf and remove the `flags offload` line from the flowtable block,
# then reload:
sudo nft -f /etc/nftables.conf