netfilter: flowtable: generalize pending status bit

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-98792
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-10-18 16:17:33 UTC
Updated2026-10-21 13:21:46 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf_flow_offload_stats() can schedule work to retrieve stats while the flow is being removed by GC. And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions. Revert the reordering done in commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") to prevent a race between GC and hw offload handler.

Risk And Classification

EPSS: 0.001680000 probability, percentile 0.057090000 (date 2026-10-21)

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 2c8897953f3b2ff5498f3f275708a742bfcdbc24 f7e292f3c8c853f27a1af7eaf3428a0e76fe5fcc git Not specified
CNA Linux Linux affected 2c8897953f3b2ff5498f3f275708a742bfcdbc24 4d52b72f3aa68ad0536444e36530bda75070194c git Not specified
CNA Linux Linux affected 2c8897953f3b2ff5498f3f275708a742bfcdbc24 4033e1a9262c57dfbfc594a591a50fcba63c531a git Not specified
CNA Linux Linux affected 2c8897953f3b2ff5498f3f275708a742bfcdbc24 a2cac45848d1cf31ed190db30f90ba8211e9a8ca git Not specified
CNA Linux Linux affected 2c8897953f3b2ff5498f3f275708a742bfcdbc24 7c549fb7eecd01fdba7c0d12c01da876ef8a3214 git Not specified
CNA Linux Linux affected 5.7 Not specified
CNA Linux Linux unaffected 5.7 semver Not specified
CNA Linux Linux unaffected 6.6.160 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.113 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.56 6.18.* semver Not specified
CNA Linux Linux unaffected 7.2.10 7.2.* semver Not specified
CNA Linux Linux unaffected 7.3 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/4d52b72f3aa68ad0536444e36530bda75070194c 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/a2cac45848d1cf31ed190db30f90ba8211e9a8ca 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/4033e1a9262c57dfbfc594a591a50fcba63c531a 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/f7e292f3c8c853f27a1af7eaf3428a0e76fe5fcc 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report