CVE-2026-98792: netfilter: flowtable: generalize pending status bit
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: generalize pending status bit
Rename NFFLOWHWPENDING to NFFLOWPENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed.
Apparently, nfflowoffloadstats() can schedule work to retrieve stats while the flow is being removed by GC.
And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions.
Revert the reordering done in commit d644b23afe1e ("netfilter: flowtable: publish HWDEAD after worker is done") to prevent a race between GC and hw offload handler.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1 - Compensating control
Inhibit the netfilter flowtable GC worker while pending hardware offload work is incomplete; keep GC disabled until the flow has been fully added in both directions.
Event History
Frequently Asked Questions
Which systems are exposed to this race condition?
Systems using the Linux kernel netfilter flowtable functionality with hardware offload activity are implicated. The race involves flowtable garbage collection and pending hardware-offload or statistics-retrieval work.
What conditions trigger the issue?
The issue can occur when nf_flow_offload_stats() schedules work to retrieve flow statistics while the flowtable garbage collector is removing the same flow. It is tied to concurrent flow removal and hardware offload handler activity.
Is there a mitigation if the kernel update cannot be applied immediately?
The provided information does not identify a configuration workaround. Reducing or disabling use of netfilter flowtables with hardware offload may avoid the affected concurrent offload path, but this is not stated as a confirmed mitigation in the available data.
How can I determine whether a system has the fix?
Check whether the installed kernel includes one of the referenced stable commits: 4d52b72f3aa68ad0536444e36530bda75070194c, 4033e1a9262c57dfbfc594a591a50fcba63c531a, or a2cac45848d1cf31ed190db30f90ba8211e9a8ca. The supplied data does not provide affected or fixed kernel version numbers.