CVE-2026-98851

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft_flow_offload: drop flowtable reference on init error path

nft_flow_offload_init() bumps the flowtable use count with

nft_use_inc() before calling nf_ct_netns_get(). When the latter

fails, the error is returned as-is and the reference is leaked.

The upper layers do not balance it either: nf_tables_newexpr()

clears expr->ops when the expression init callback fails, so the

nft_expr_more() iteration in nft_rule_expr_deactivate() and

nf_tables_rule_destroy() stops right before the failed expression

and its ->destroy callback, which would drop the reference, never

runs.

Each failed rule addition therefore leaks one flowtable reference

and the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE

keeps reporting -EBUSY even though no rule references it.

Save the nf_ct_netns_get() return value and undo the nft_use_inc()

when it fails, restoring the inc/dec pairing within

nft_flow_offload_init() itself.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References