All vulnerabilities
CVE-2026-98851

Linux: netfilter: nft_flow_offload: drop flowtable reference on init error path

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1d27214fd9a4d2c0c6d998fc9d4fb61448a3438eAlso 64ac0cb574c740bf723affb79b646eeba920db6b, 4cd378423a33194a773c267fc58606d28fce95cf and 1 moreCVE List
Published18 Oct 2026Updated 21 Oct 2026CVE List

What fixes it

  • 1d27214fd9a4d2c0c6d998fc9d4fb61448a3438eLinuxCVE List
  • 64ac0cb574c740bf723affb79b646eeba920db6bLinuxCVE List
  • 4cd378423a33194a773c267fc58606d28fce95cfLinuxCVE List
  • 747928b5d4ff8c8de55138a54c13980e4bb88578LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_flow_offload: drop flowtable reference on init error path

nft_flow_offload_init() bumps the flowtable use count with nft_use_inc() before calling nf_ct_netns_get(). When the latter fails, the error is returned as-is and the reference is leaked.

The upper layers do not balance it either: nf_tables_newexpr() clears expr->ops when the expression init callback fails, so the nft_expr_more() iteration in nft_rule_expr_deactivate() and nf_tables_rule_destroy() stops right before the failed expression and its ->destroy callback, which would drop the reference, never runs.

Each failed rule addition therefore leaks one flowtable reference and the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE keeps reporting -EBUSY even though no rule references it.

Save the nf_ct_netns_get() return value and undo the nft_use_inc() when it fails, restoring the inc/dec pairing within nft_flow_offload_init() itself.

Text from CVE List

Affected versions 12

  • Linuxaffected: a3c90f7a2323b331ae816d5b0633e68148e25d04 before 1d27214fd9a4d2c0c6d998fc9d4fb61448a3438eCVE List
  • Linuxaffected: a3c90f7a2323b331ae816d5b0633e68148e25d04 before 64ac0cb574c740bf723affb79b646eeba920db6bCVE List
  • Linuxaffected: a3c90f7a2323b331ae816d5b0633e68148e25d04 before c5f91098edee98c015f78488460a0609e62582a5CVE List
  • Linuxaffected: a3c90f7a2323b331ae816d5b0633e68148e25d04 before 4cd378423a33194a773c267fc58606d28fce95cfCVE List
  • Linuxaffected: a3c90f7a2323b331ae816d5b0633e68148e25d04 before 747928b5d4ff8c8de55138a54c13980e4bb88578CVE List
  • Linuxaffected: 4.16CVE List
  • Linuxunaffected: all versions before 4.16CVE List
  • Linuxunaffected: 6.6.160 through 6.6.*CVE List
  • Linuxunaffected: 6.12.113 through 6.12.*CVE List
  • Linuxunaffected: 6.18.56 through 6.18.*CVE List
  • Linuxunaffected: 7.2.10 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 5