CVE-2026-98320: netfilter: flowtable: hold reference on ct until flow is released
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: hold reference on ct until flow is released
nfctput() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period.
Add rcubarrier() on module exit path, to ensure pending flow entries are release before module goes away.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.158.1-1 - Compensating control
Add rcu_barrier() to the netfilter flowtable module exit path to ensure pending flow entries have completed their RCU grace period before the module is unloaded.
- Compensating control
Hold a reference on the conntrack (ct) object until the associated flow is released, preventing nf_ct_put() from releasing ct->ext prematurely and avoiding references to the wrong conntrack.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux kernel systems using the netfilter flowtable and conntrack functionality are relevant. The provided information does not identify affected kernel versions or state whether these features are enabled by default.
What is the security impact described by the fix?
A flowtable datapath could retain a reference after the conntrack object's extension area was released, potentially allowing it to refer to the wrong conntrack entry under RCU semantics. The fix keeps the conntrack reference until the flow is released after an RCU grace period.
What should be considered when unloading the affected module?
The fix adds an rcu_barrier() to the module-exit path so pending flow entries are released before the module is removed. Systems without this change may not wait for pending flow-entry release during module exit.