{"id":"CVE-2026-98320","published":"2026-10-06T09:18:23.957","lastModified":"2026-10-07T07:17:08.847","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct->ext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away.","cvssScore":7.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f","tags":[]},{"url":"https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6","tags":[]},{"url":"https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25","tags":[]},{"url":"https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de","tags":[]},{"url":"https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc","tags":[]},{"url":"https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74","tags":[]},{"url":"https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d","tags":[]},{"url":"https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"The Linux kernel's netfilter flowtable implementation has a reference counting issue where connection tracking (ct) structures are released too early, potentially leading to use-after-free conditions when accessing stale data from the flowtable datapath. This can result in arbitrary code execution or system instability.","exploitability":"Exploitation requires local user access with specific kernel module interaction and precise timing to trigger the race condition, making it moderately difficult but possible to achieve remote code execution through kernel memory corruption.","blast_radius":"If exploited, this vulnerability could affect any Linux system running with netfilter flowtables enabled, potentially leading to full system compromise or denial of service across network services relying on connection tracking.","remediation":"Apply the kernel patch included in the 6.12.2 kernel release to fix the reference counting issue in the netfilter flowtable implementation.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["kernel","netfilter","rce","memory-corruption"],"model":"garnet-coder","analyzedAt":"2026-10-14T09:03:19.904Z"}}