CVE-2026-98792 netfilter: flowtable: generalize pending status bit
A race condition in the Linux kernel netfilter flowtable allows a remote attacker to cause a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98792?
CVE-2026-98792 is a vulnerability in Linux, published on 18 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: generalize pending status bit
Rename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed.
Apparently, nf_flow_offload_stats() can schedule work to retrieve stats while the flow is being removed by GC.
And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions.
Revert the reordering done in commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") to prevent a race between GC and hw offload handler.
Which versions are affected by CVE-2026-98792?
How do I fix CVE-2026-98792?
Apply the vendor's patch.
Is CVE-2026-98792 being exploited?
There is no known exploitation of CVE-2026-98792 in the wild and no public exploit code.
Sources
Also known as AZL-108999, BELL-CVE-2026-98792, DEBIAN-CVE-2026-98792, GHSA-j4c9-hvw2-vg7q, UBUNTU-CVE-2026-98792.