CVE-2026-98625: netfilter: flowtable: publish HW_DEAD after worker is done
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish HWDEAD after worker is done
flowoffloadworkdel() sets NFFLOWHWDEAD before the work handler clears NFFLOWHWPENDING. Once a flow is both HWDYING and HWDEAD, a concurrent garbage collection pass can remove it and schedule it for RCU freeing.
The offload worker holds neither an RCU read lock nor a reference to the flow. If it is preempted after publishing HWDEAD, the RCU callback can free the flow before the worker resumes and clears HWPENDING, resulting in a use-after-free.
Move HWDEAD publication to the common worker epilogue after the pending bit is cleared, making it the final flow access by destroy work. Order all preceding flow accesses before publishing the bit that allows garbage collection to free the object.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
The race involves netfilter flowtable hardware offload destruction, concurrent garbage collection, and RCU freeing. Systems not using the affected flow-offload path are not described as exposed by the available information.
What sequence causes the use-after-free?
A destroy worker can mark a flow HW_DEAD while it is still HW_PENDING. If the flow is also HW_DYING, garbage collection can remove and schedule it for RCU freeing while the worker is preempted, leaving the worker to access a freed flow when it resumes.
What does the fix change?
The fix delays publication of HW_DEAD until the worker epilogue, after HW_PENDING is cleared. This makes HW_DEAD the worker's final flow access and prevents garbage collection from freeing the flow while the worker can still use it.