CVE-2026-98622

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure

flow_offload_alloc() returns NULL when the conntrack entry is dying

(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation

fails; both are expected under load and neither is a kernel bug. This

path runs from softirq on every committed packet, so with

panic_on_warn=1 an unprivileged user can panic the box just by racing

a conntrack flush against a `tc ... action ct commit` classifier.

Reproduced with a custom repro under QEMU: a small, fixed set of UDP

flows through `tc filter ... action ct commit` on lo, raced against

threads flooding bare ctnetlink CT_DELETE (flush) requests. Hits

WARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined

into tcf_ct_act() in this build) within ~15s on the unpatched kernel;

same setup is clean on the patched kernel. The fix itself is

behavior-preserving: both branches already did `goto err_al

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References