{"id":"CVE-2026-98625","revision":"380e08dbabdf486dbf012a5a778fc531","records":[{"revision":"380e08dbabdf486dbf012a5a778fc531","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-98625","aliases":[],"title":"netfilter: flowtable: publish HW_DEAD after worker is done","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: publish HW_DEAD after worker is done\n\nflow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler\nclears NF_FLOW_HW_PENDING. Once a flow is both HW_DYING and HW_DEAD, a\nconcurrent garbage collection pass can remove it and schedule it for RCU\nfreeing.\n\nThe offload worker holds neither an RCU read lock nor a reference to the\nflow. If it is preempted after publishing HW_DEAD, the RCU callback can\nfree the flow before the worker resumes and clears HW_PENDING, resulting\nin a use-after-free.\n\nMove HW_DEAD publication to the common worker epilogue after the pending\nbit is cleared, making it the final flow access by destroy work. Order all\npreceding flow accesses before publishing the bit that allows garbage\ncollection to free the object.","state":0,"publishedAt":"2026-10-18T15:19:46.372+00:00","modifiedAt":"2026-10-19T09:22:53.321+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nf_flow_table_offload.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"f92e8f39726ba68a7c42c6b7566be687c8161579\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"00e452a7ca9fda135ea3d04a11128d5088e354a8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"56f39c7d139bb76072efe2fb3dcafc13ba915ad8\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"e20701843032c438f879066a77ea85e361c6b999\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"b4f0f05dfbe836a171bff261f17d098a4d5461ea\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"b0ef9450e93f2adeb77593db14c2ac7c6c8f5060\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"f26652e99f519e6bd34f8a9b48fbb33c603585f2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"2c8897953f3b2ff5498f3f275708a742bfcdbc24\",\n                            \"lessThan\": \"d644b23afe1ef509c9961a6d84a093c2587edf02\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/netfilter/nf_flow_table_offload.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.271\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.222\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.189\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.158\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.112\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.55\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.9\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/f92e8f39726ba68a7c42c6b7566be687c8161579","https://git.kernel.org/stable/c/00e452a7ca9fda135ea3d04a11128d5088e354a8","https://git.kernel.org/stable/c/56f39c7d139bb76072efe2fb3dcafc13ba915ad8","https://git.kernel.org/stable/c/e20701843032c438f879066a77ea85e361c6b999","https://git.kernel.org/stable/c/b4f0f05dfbe836a171bff261f17d098a4d5461ea","https://git.kernel.org/stable/c/b0ef9450e93f2adeb77593db14c2ac7c6c8f5060","https://git.kernel.org/stable/c/f26652e99f519e6bd34f8a9b48fbb33c603585f2","https://git.kernel.org/stable/c/d644b23afe1ef509c9961a6d84a093c2587edf02"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-98625","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-98625","identifiers":["CVE-2026-98625"]},"retained":false,"historicalAffected":[]}],"coverage":[]}