CVE-2026-90062 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_tables: move hardware offload step after building the chain blob
Allocate the chain blob before the ruleset offload to reduce chances of entering an inconsistent state where the offloaded ruleset in the nic and the software ruleset differ.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability addressed involves a race condition within the Linux kernel's netfilter subsystem, specifically concerning the nf_tables module when hardware offloading is enabled. In network environments that utilize Network Interface Cards capable of offloading packet filtering decisions to hardware, there exists a critical synchronization requirement between the software-based ruleset maintained by the kernel and the corresponding configuration pushed to the NIC firmware or ASIC. The flaw originates from an incorrect ordering in the initialization sequence for chain configurations during this offload process. Specifically, the system was attempting to perform the hardware offload step before fully constructing and validating the complete chain blob data structure within the software stack. This premature execution creates a window of opportunity where the state of the ruleset on the network interface card can diverge from the authoritative state maintained by the Linux kernel's netfilter subsystem.
This inconsistency represents a significant integrity failure in packet processing logic. When the hardware offload occurs before the chain blob is fully built, the NIC may begin filtering traffic based on incomplete or partially configured rule sets. This discrepancy means that packets might be accepted, dropped, or redirected according to rules that do not yet exist or are not correctly defined in the kernel's view of the network policy. Such a state can lead to unpredictable network behavior, including security bypasses where malicious traffic is allowed through because the hardware has already committed to an older or incomplete rule set, or conversely, legitimate traffic being dropped due to premature enforcement of rules that were intended for future configuration steps. The core issue lies in the atomicity and ordering of operations during dynamic updates to firewall chains, which are common in high-throughput network environments where performance optimizations via hardware offloading are heavily utilized.
From a classification perspective, this flaw aligns with CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, as it involves a race condition between the software ruleset construction and the hardware synchronization process. It also relates to CWE-841, Improper Enforcement of Behavioral Workflow, because the system fails to enforce the correct sequence of operations required for safe state transition during rule updates. In terms of MITRE ATT&CK mapping, this vulnerability could potentially be leveraged in conjunction with other techniques under Tactic TA0005 (Defense Evasion) or TA0001 (Initial Access), allowing an attacker who has some level of control over network traffic patterns to exploit the inconsistency for evasion purposes. For instance, if an adversary can influence the timing of rule updates or trigger specific chain modifications during this vulnerable window, they might manipulate the firewall's behavior to bypass security controls temporarily.
The operational impact of this vulnerability is primarily centered on reliability and security assurance in enterprise networks that depend on hardware-accelerated packet filtering. Administrators relying on nf_tables for complex routing and filtering policies may find their network segmentation or intrusion prevention mechanisms compromised if the offloaded rules do not match the intended configuration. This can result in data exfiltration, unauthorized access to protected segments, or denial of service conditions caused by misrouted traffic. The risk is particularly acute in dynamic environments where firewall rules are frequently updated via scripts or orchestration tools that interact with the netfilter subsystem programmatically.
To mitigate this vulnerability, it is essential to apply the kernel patches provided by Linux distribution maintainers that correct the ordering of operations within the nf_tables hardware offload path. The fix ensures that the chain blob is fully allocated and validated before any attempt is made to synchronize the state with the network interface card's hardware engine. System administrators should verify their kernel versions against vendor advisories and apply updates promptly, especially in environments where high-performance packet filtering via NICs is enabled. Additionally, monitoring for anomalies in firewall logs that indicate unexpected traffic patterns can serve as a detection mechanism while patching efforts are underway. Regular audits of network security configurations and ensuring that offloading features are tested thoroughly during rule changes can further reduce the risk associated with such synchronization flaws.