CVE-2026-98851: netfilter: nft_flow_offload: drop flowtable reference on init error path
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nftflowoffload: drop flowtable reference on init error path
nftflowoffloadinit() bumps the flowtable use count with nftuseinc() before calling nfctnetnsget(). When the latter fails, the error is returned as-is and the reference is leaked.
The upper layers do not balance it either: nftablesnewexpr() clears expr->ops when the expression init callback fails, so the nftexprmore() iteration in nftruleexprdeactivate() and nftablesruledestroy() stops right before the failed expression and its ->destroy callback, which would drop the reference, never runs.
Each failed rule addition therefore leaks one flowtable reference and the flowtable can no longer be removed: NFTMSGDELFLOWTABLE keeps reporting -EBUSY even though no rule references it.
Save the nfctnetnsget() return value and undo the nftuseinc() when it fails, restoring the inc/dec pairing within nftflowoffloadinit() itself.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.113-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.10-1 - Upgrade
Upgrade
debian/linux-6.12to a version that resolves this vulnerability.Fixed in 6.12.113-1~deb12u1 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.10.273 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 5.15.224 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.113 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.56 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.10 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Upgrade
Upgrade
azurelinux/kernelto a version that resolves this vulnerability.Fixed in 6.6.161.1-1
Event History
Frequently Asked Questions
What conditions are required to trigger the leaked flowtable reference?
A rule addition must use the nft_flow_offload expression, and its initialization must reach a failure from nf_ct_netns_get() after nft_use_inc() has incremented the flowtable use count. Each such failed rule addition leaks one reference.
What is the operational impact if the issue is triggered?
The affected flowtable remains permanently busy despite having no rule references. Attempts to remove it with NFT_MSG_DELFLOWTABLE return -EBUSY.
How can an administrator identify an affected flowtable?
A flowtable may be affected when it has no rules referencing it but deletion through NFT_MSG_DELFLOWTABLE continues to fail with -EBUSY. The condition follows one or more failed additions of rules using nft_flow_offload.
What does the fix change?
The fix drops the flowtable reference when nf_ct_netns_get() fails during nft_flow_offload initialization. This restores the expected increment/decrement pairing within nft_flow_offload_init().