CVE-2026-98625 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish HW_DEAD after worker is done
flow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler clears NF_FLOW_HW_PENDING. Once a flow is both HW_DYING and HW_DEAD, a concurrent garbage collection pass can remove it and schedule it for RCU freeing.
The offload worker holds neither an RCU read lock nor a reference to the flow. If it is preempted after publishing HW_DEAD, the RCU callback can free the flow before the worker resumes and clears HW_PENDING, resulting in a use-after-free.
Move HW_DEAD publication to the common worker epilogue after the pending bit is cleared, making it the final flow access by destroy work. Order all preceding flow accesses before publishing the bit that allows garbage collection to free the object.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/18/2026
The vulnerability identified within the Linux kernel's netfilter subsystem represents a critical race condition in the hardware offload flow table management logic. Specifically, this issue resides in the interaction between the flow offload worker and the concurrent garbage collection mechanism responsible for cleaning up stale or terminated network flows. The core of the problem lies in the ordering of state flag updates during the destruction phase of an offloaded flow entry. When a flow is marked for deletion, the system sets the NF_FLOW_HW_DEAD flag to indicate that hardware resources associated with the flow should be released. However, prior to this fix, this dead status was published before the worker cleared the NF_FLOW_HW_PENDING bit, which signals that the worker is actively processing or has completed its task on that specific flow entry.
This incorrect ordering creates a dangerous window of opportunity for concurrent operations. The garbage collection pass operates independently and checks these flags to determine if an object can be safely removed from memory. If it observes both NF_FLOW_HW_DYING and NF_FLOW_HW_DEAD, it assumes the flow is no longer in use by any worker thread and proceeds to schedule the structure for RCU (Read-Copy-Update) freeing. Because the offload worker does not hold an RCU read lock or a reference count on the flow object during its execution, there is no mechanism preventing this premature deallocation. If the kernel scheduler preempts the worker after it has published HW_DEAD but before it clears HW_PENDING, the garbage collector may execute and free the memory associated with that flow entry while the worker thread still holds pointers to or references within that now-freed structure.
The operational impact of this flaw is a use-after-free vulnerability, which falls under CWE-416 in the Common Weakness Enumeration taxonomy. This type of error occurs when a program continues to use a pointer after it has been freed, leading to undefined behavior. In the context of network processing within the Linux kernel, such memory corruption can result in system crashes, denial of service conditions where the networking stack becomes unstable or unresponsive, and potentially arbitrary code execution if an attacker can carefully craft packet sequences to exploit this race condition. The lack of proper synchronization primitives like RCU read locks during critical sections allows the concurrency bug to manifest under high-load scenarios or specific timing conditions that trigger preemption at the precise moment between publishing death status and clearing pending status.
To resolve this issue, the fix reorders the operations within the flow offload worker's epilogue. The publication of the HW_DEAD flag is moved to occur only after the NF_FLOW_HW_PENDING bit has been cleared by the worker itself. This ensures that the dead state is published as the final action regarding flow access during the destruction process. By guaranteeing that all preceding accesses to the flow object happen before the flags are set in a way that permits garbage collection, the system maintains memory safety. This change effectively eliminates the race window where the garbage collector could free the object while it was still being accessed by the worker thread.
From a mitigation perspective, this vulnerability is addressed through kernel code updates that enforce strict ordering of state transitions and resource cleanup operations in the netfilter subsystem. Administrators should ensure their systems are updated with patches containing these fixes to prevent potential exploitation. The remediation aligns with best practices for concurrent programming in operating system kernels, emphasizing the importance of proper synchronization mechanisms such as RCU read locks or reference counting when dealing with shared data structures that may be concurrently accessed and freed by different threads or interrupt contexts. This case highlights the necessity of rigorous code review focusing on lock ordering and state machine transitions in high-performance networking components to prevent subtle concurrency bugs from escalating into severe security vulnerabilities classified under MITRE ATT&CK techniques related to privilege escalation or system compromise via memory corruption.