CVE-2026-98320: netfilter: flowtable: hold reference on ct until flow is released
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: hold reference on ct until flow is released
nfctput() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period.
Add rcubarrier() on module exit path, to ensure pending flow entries are release before module goes away.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add rcu_barrier() to the netfilter flowtable module exit path to ensure pending flow entries have completed their RCU grace period before the module is unloaded.
- Compensating control
Hold a reference on the conntrack (ct) object until the associated flow is released, preventing nf_ct_put() from releasing ct->ext prematurely and avoiding references to the wrong conntrack.