Vulnerability-Lookup

GHSA-7RM7-MF5X-673X

Vulnerability from github – Published: 2026-10-06 09:31 – Updated: 2026-10-07 09:32

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: hold reference on ct until flow is released

nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period.

Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-98320"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-10-06T09:18:23Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct-\u003eext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away.",
  "id": "GHSA-7rm7-mf5x-673x",
  "modified": "2026-10-07T09:32:16Z",
  "published": "2026-10-06T09:31:35Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98320"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

CVE-2026-98320 (GCVE-0-2026-98320)

Vulnerability from cvelistv5 – Published: 2026-10-06 08:46 – Updated: 2026-10-07 06:50

Title

netfilter: flowtable: hold reference on ct until flow is released

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: hold reference on ct until flow is released nf_ct_put() releases the ct->ext area inmediately, the rcu typesafe semantics also allow to refer to the wrong conntrack from the flowtable datapath. Hold reference on ct until flow is released after rcu grace period. Add rcu_barrier() on module exit path, to ensure pending flow entries are release before module goes away.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux CNA under the mitre root

CNA scorecard D 53/100 over 6664 records in the last 180 days details

References

8 references

URL	Tags
https://git.kernel.org/stable/c/93ff1594be1aad4da…
https://git.kernel.org/stable/c/eed6997e8dc40593a…
https://git.kernel.org/stable/c/61c6688be282277c6…
https://git.kernel.org/stable/c/a43cd2b67b91e9432…
https://git.kernel.org/stable/c/8274cdc5f9c57e17e…
https://git.kernel.org/stable/c/12c1ac230f4ca16e0…
https://git.kernel.org/stable/c/d9e6175a3ee48209e…
https://git.kernel.org/stable/c/e75a9fa1d44bcbd66…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 93ff1594be1aad4da364462dd8db050ebcfda2de (git) Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < eed6997e8dc40593a539fcc722e7ed51b18db86c (git) Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 61c6688be282277c6e91ab286a7acd0ae8681ac6 (git) Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < a43cd2b67b91e943273c913237a7a88c50cdcfbc (git) Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 8274cdc5f9c57e17ed77fc4ba76212536c840f25 (git) Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < 12c1ac230f4ca16e0017b62a963ab75e0b48074f (git) Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < d9e6175a3ee48209ee65f294fc567b4e16b29b74 (git) Affected: 0ff90b6c20340e57616a51ae1a1bf18156d6638a , < e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d (git)
Linux	Linux	Affected: 4.16 Unaffected: 0 , < 4.16 (semver) Unaffected: 5.10.271 , ≤ 5.10.* (semver) Unaffected: 5.15.222 , ≤ 5.15.* (semver) Unaffected: 6.1.189 , ≤ 6.1.* (semver) Unaffected: 6.6.158 , ≤ 6.6.* (semver) Unaffected: 6.12.112 , ≤ 6.12.* (semver) Unaffected: 6.18.54 , ≤ 6.18.* (semver) Unaffected: 7.2.8 , ≤ 7.2.* (semver) Unaffected: 7.3-rc4 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "93ff1594be1aad4da364462dd8db050ebcfda2de",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "eed6997e8dc40593a539fcc722e7ed51b18db86c",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "61c6688be282277c6e91ab286a7acd0ae8681ac6",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "a43cd2b67b91e943273c913237a7a88c50cdcfbc",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "8274cdc5f9c57e17ed77fc4ba76212536c840f25",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "12c1ac230f4ca16e0017b62a963ab75e0b48074f",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "d9e6175a3ee48209ee65f294fc567b4e16b29b74",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            },
            {
              "lessThan": "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d",
              "status": "affected",
              "version": "0ff90b6c20340e57616a51ae1a1bf18156d6638a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.16"
            },
            {
              "lessThan": "4.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc4",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc4",
                  "versionStartIncluding": "4.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct-\u003eext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The freed ct is reached from nf_flow_offload_forward() (nf_ct_acct_update/flow_offload_teardown on flow-\u003ect) but freeing it needs the conntrack killed (nf_ct_is_dying) and flow_offload_del() run; a remote peer only supplies forwarded packets and cannot kill an offloaded ct, so the full trigger needs local nftables/ctnetlink access.\nAC:L - The attacker drives every side of the race: they flood packets through their own flowtable, delete the ct via ctnetlink, and force nf_flow_offload_gc_step()-\u003eflow_offload_del() at once by downing the veth (nf_flow_table_gc_cleanup flush_delayed_work). The window is narrow but can be retried indefinitely.\nPR:L - Creating the nftables flowtable, adding veth forwarding and sending IPCTNL_MSG_CT_DELETE need only CAP_NET_ADMIN in a network namespace, which an unprivileged user gets via unshare -Urn.\nUI:N - No victim action is needed; the attacker sets up the flowtable, the traffic and the conntrack/flow teardown entirely within their own namespace.\nS:U - Memory corruption in the host kernel\u0027s netfilter flowtable/conntrack objects yields kernel privilege escalation within the same authority; no VM or hardware boundary is crossed.\nC:H - flow_offload_free() dropped the ct reference before the RCU grace period, so in-flight readers dereference ct-\u003eext after nf_conntrack_free() has kfree\u0027d it, or a recycled SLAB_TYPESAFE_BY_RCU nf_conn now owned by another connection - a use-after-free that can be groomed to leak kernel memory.\nI:H - The stale reader writes freed or reused memory: nf_ct_acct_add() does atomic64_add into the freed ct-\u003eext counters, and flow_offload_teardown()/flow_offload_fixup_ct() modify status/timeout of a recycled conntrack, giving heap-corruption primitives.\nA:H - The use-after-free on ct-\u003eext and recycled nf_conn objects in the forwarding softirq can corrupt the slab and crash the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-07T06:50:01.858Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de"
        },
        {
          "url": "https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c"
        },
        {
          "url": "https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6"
        },
        {
          "url": "https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc"
        },
        {
          "url": "https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25"
        },
        {
          "url": "https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74"
        },
        {
          "url": "https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d"
        }
      ],
      "title": "netfilter: flowtable: hold reference on ct until flow is released",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98320",
    "datePublished": "2026-10-06T08:46:14.757Z",
    "dateReserved": "2026-09-25T10:25:14.340Z",
    "dateUpdated": "2026-10-07T06:50:01.858Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted