CVE-2026-98851 Overview
CVE-2026-98851 is a resource management vulnerability in the Linux kernel's netfilter subsystem, specifically in the nft_flow_offload expression. The flaw lives in nft_flow_offload_init(), which increments the flowtable use counter via nft_use_inc() before calling nf_ct_netns_get(). When nf_ct_netns_get() fails, the function returns the error without decrementing the reference, leaking a flowtable reference on each failed rule addition.
Upper layers do not compensate for the leak. As a result, the affected flowtable can no longer be removed, and NFT_MSG_DELFLOWTABLE continues to return -EBUSY even when no rules reference it.
Critical Impact
Repeated failed nft rule additions permanently pin flowtables in the kernel, blocking cleanup and enabling a local denial-of-service against netfilter configuration.
Affected Products
- Linux kernel (upstream mainline) with the nft_flow_offload netfilter expression
- Linux stable branches patched via commits 1d27214, 4cd3784, 64ac0cb, 747928b, and c5f9109
- Distributions shipping unpatched kernels that enable CONFIG_NF_TABLES with flow offload support
Discovery Timeline
- 2026-10-18 - CVE-2026-98851 published to NVD
- 2026-10-21 - Last updated in NVD database
Technical Details for CVE-2026-98851
Vulnerability Analysis
The defect is a classic reference-counting imbalance on an error path inside the netfilter nftables flow offload expression. nft_flow_offload_init() is the init callback invoked when a user adds an nft rule containing a flow offload statement. The function first calls nft_use_inc() on the referenced flowtable to record a new user, then calls nf_ct_netns_get() to pin the conntrack network namespace infrastructure.
When nf_ct_netns_get() fails, the function returns the error directly. The matching nft_use_dec() is skipped. Because the expression's ->destroy callback is the normal site that would drop the reference, and because that callback never runs on this path, the inc/dec pair is permanently broken.
The cleanup machinery in nf_tables_newexpr() clears expr->ops when an expression init callback fails. Consequently, nft_expr_more() in nft_rule_expr_deactivate() and nf_tables_rule_destroy() halts iteration right before the failed expression, guaranteeing that ->destroy is never invoked for it.
Root Cause
The root cause is an unbalanced reference acquisition on an error path, a kernel memory and resource lifecycle bug rather than a memory-safety violation. The author of nft_flow_offload_init() assumed the upper netfilter layer would call the expression's ->destroy on failure, but the framework explicitly suppresses that call when init returns an error.
Attack Vector
Exploitation requires the ability to add nftables rules, which typically needs CAP_NET_ADMIN within a network namespace. An unprivileged user inside a user namespace with CAP_NET_ADMIN in a non-root netns can repeatedly submit rules that reference a flowtable while forcing nf_ct_netns_get() to fail. Each failed rule insertion leaks one reference, eventually making the flowtable undeletable and consuming kernel resources associated with the pinned object.
No verified public exploit is available. The patched behavior saves the return value of nf_ct_netns_get() and invokes nft_use_dec() on failure, restoring the inc/dec pairing inside nft_flow_offload_init() itself. See the Kernel Git Commit 1d27214 for the exact fix.
Detection Methods for CVE-2026-98851
Indicators of Compromise
- Repeated NFT_MSG_DELFLOWTABLE operations failing with -EBUSY despite no rule referencing the flowtable.
- Unexpected growth in the number of flowtable objects visible through nft list ruleset that cannot be removed by administrators.
- Audit records showing high-volume failed nft rule additions originating from unprivileged workloads or containers.
Detection Strategies
- Monitor netlink audit events (AUDIT_NETFILTER_CFG) for bursts of failed nftables rule insertions tied to a single UID, container, or network namespace.
- Track kernel memory accounting for nf_tables slabs and look for monotonic growth that does not correlate with legitimate ruleset changes.
- Compare the running kernel version against the fixed stable commits listed in the patch references.
Monitoring Recommendations
- Alert when administrative attempts to delete a flowtable repeatedly return EBUSY with no corresponding referencing rule.
- Baseline normal nft rule-change rates per namespace and flag outliers from container workloads.
- Collect kernel version inventory across Linux fleets and continuously reconcile against vendor security advisories.
How to Mitigate CVE-2026-98851
Immediate Actions Required
- Inventory Linux hosts running kernels that predate the fix commits and prioritize those exposing nftables configuration to untrusted containers or user namespaces.
- Apply vendor-supplied kernel updates that incorporate the upstream patch for nft_flow_offload_init().
- Restrict CAP_NET_ADMIN within unprivileged user namespaces where feasible, especially on multi-tenant hosts.
Patch Information
The upstream fix is distributed across the following stable commits: Kernel Git Commit 1d27214, Kernel Git Commit 4cd3784, Kernel Git Commit 64ac0cb, Kernel Git Commit 747928b, and Kernel Git Commit c5f9109. The patch stores the result of nf_ct_netns_get() and calls nft_use_dec() on failure before returning the error.
Workarounds
- Disable or avoid loading the nft_flow_offload module on systems that do not require hardware or software flow offload.
- Prevent untrusted workloads from obtaining CAP_NET_ADMIN in their network namespace using seccomp, user namespace restrictions, or container runtime policies.
- Monitor and rate-limit nftables configuration operations from non-administrative principals.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
