CVE-2026-98484

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: skip expired catchall elements on insert and delete

nft_setelem_catchall_insert() looks up duplicates with

nft_set_elem_active() only, while nft_set_catchall_lookup() and the

dump path additionally skip expired elements.

Once a catchall element with a timeout expires, this predicate drift

makes it invisible to userspace dumps, yet it still blocks

re-insertion: with NLM_F_EXCL the request fails with -EEXIST, and

without it the request reports success but silently inserts nothing.

The stale entry only goes away when the (user-tunable) gc interval

elapses, so the catchall rule may silently stop matching for an

arbitrarily long time after its first expiration.

The delete path shows the same drift: nft_setelem_catchall_deactivate()

picks the first active-next entry in the catchall list, so with an

expired entry still pending GC it retires the stale entry instead of

the fresh one, and it deactivates

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References