{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98622", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.360Z", "datePublished": "2026-10-18T15:19:42.514Z", "dateUpdated": "2026-10-19T09:22:50.359Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:22:50.359Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: don't WARN on benign flow_offload_alloc() failure\n\nflow_offload_alloc() returns NULL when the conntrack entry is dying\n(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation\nfails; both are expected under load and neither is a kernel bug. This\npath runs from softirq on every committed packet, so with\npanic_on_warn=1 an unprivileged user can panic the box just by racing\na conntrack flush against a `tc ... action ct commit` classifier.\n\nReproduced with a custom repro under QEMU: a small, fixed set of UDP\nflows through `tc filter ... action ct commit` on lo, raced against\nthreads flooding bare ctnetlink CT_DELETE (flush) requests. Hits\nWARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined\ninto tcf_ct_act() in this build) within ~15s on the unpatched kernel;\nsame setup is clean on the patched kernel. The fix itself is\nbehavior-preserving: both branches already did `goto err_alloc`\nbefore and after, only the WARN is removed."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "e8fcf3f08834e939b797311742ee72b1e2a08096", "status": "affected", "versionType": "git"}, {"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "af475f599270e59313552e6c6f3af8507da672b8", "status": "affected", "versionType": "git"}, {"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "424ba52c0058deeb940d02cba52eb0aeb288db33", "status": "affected", "versionType": "git"}, {"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "d512c484bd93a5f2794aa03c9faeb7bcb82dbd4a", "status": "affected", "versionType": "git"}, {"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "d805560ad69cb266d669341ca01e26bffb0d2c67", "status": "affected", "versionType": "git"}, {"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "00734f3684fcec42c319bedfe68a5d357c720b53", "status": "affected", "versionType": "git"}, {"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "650787233c2fd6e515a7c5f371019a9fa080ccd2", "status": "affected", "versionType": "git"}, {"version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "lessThan": "47abe7a5c4eb53269aca3506446f851572a059a3", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/sched/act_ct.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e8fcf3f08834e939b797311742ee72b1e2a08096"}, {"url": "https://git.kernel.org/stable/c/af475f599270e59313552e6c6f3af8507da672b8"}, {"url": "https://git.kernel.org/stable/c/424ba52c0058deeb940d02cba52eb0aeb288db33"}, {"url": "https://git.kernel.org/stable/c/d512c484bd93a5f2794aa03c9faeb7bcb82dbd4a"}, {"url": "https://git.kernel.org/stable/c/d805560ad69cb266d669341ca01e26bffb0d2c67"}, {"url": "https://git.kernel.org/stable/c/00734f3684fcec42c319bedfe68a5d357c720b53"}, {"url": "https://git.kernel.org/stable/c/650787233c2fd6e515a7c5f371019a9fa080ccd2"}, {"url": "https://git.kernel.org/stable/c/47abe7a5c4eb53269aca3506446f851572a059a3"}], "title": "net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e8fcf3f08834e939b797311742ee72b1e2a08096", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}, {"lessThan": "af475f599270e59313552e6c6f3af8507da672b8", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}, {"lessThan": "424ba52c0058deeb940d02cba52eb0aeb288db33", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}, {"lessThan": "d512c484bd93a5f2794aa03c9faeb7bcb82dbd4a", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}, {"lessThan": "d805560ad69cb266d669341ca01e26bffb0d2c67", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}, {"lessThan": "00734f3684fcec42c319bedfe68a5d357c720b53", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}, {"lessThan": "650787233c2fd6e515a7c5f371019a9fa080ccd2", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}, {"lessThan": "47abe7a5c4eb53269aca3506446f851572a059a3", "status": "affected", "version": "64ff70b80fd403110b67dd9f7184a604fdb0da43", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/sched/act_ct.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: don't WARN on benign flow_offload_alloc() failure\n\nflow_offload_alloc() returns NULL when the conntrack entry is dying\n(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation\nfails; both are expected under load and neither is a kernel bug. This\npath runs from softirq on every committed packet, so with\npanic_on_warn=1 an unprivileged user can panic the box just by racing\na conntrack flush against a `tc ... action ct commit` classifier.\n\nReproduced with a custom repro under QEMU: a small, fixed set of UDP\nflows through `tc filter ... action ct commit` on lo, raced against\nthreads flooding bare ctnetlink CT_DELETE (flush) requests. Hits\nWARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined\ninto tcf_ct_act() in this build) within ~15s on the unpatched kernel;\nsame setup is clean on the patched kernel. The fix itself is\nbehavior-preserving: both branches already did `goto err_alloc`\nbefore and after, only the WARN is removed."}], "id": "CVE-2026-98622", "lastModified": "2026-10-19T10:19:26.330", "metrics": {}, "published": "2026-10-18T16:17:15.117", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/00734f3684fcec42c319bedfe68a5d357c720b53"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/424ba52c0058deeb940d02cba52eb0aeb288db33"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/47abe7a5c4eb53269aca3506446f851572a059a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/650787233c2fd6e515a7c5f371019a9fa080ccd2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af475f599270e59313552e6c6f3af8507da672b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d512c484bd93a5f2794aa03c9faeb7bcb82dbd4a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d805560ad69cb266d669341ca01e26bffb0d2c67"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e8fcf3f08834e939b797311742ee72b1e2a08096"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure", "id": "2554924", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2554924"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.7", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-617", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnet/sched: act_ct: don't WARN on benign flow_offload_alloc() failure\nflow_offload_alloc() returns NULL when the conntrack entry is dying\n(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation\nfails; both are expected under load and neither is a kernel bug. This\npath runs from softirq on every committed packet, so with\npanic_on_warn=1 an unprivileged user can panic the box just by racing\na conntrack flush against a `tc ... action ct commit` classifier.\nReproduced with a custom repro under QEMU: a small, fixed set of UDP\nflows through `tc filter ... action ct commit` on lo, raced against\nthreads flooding bare ctnetlink CT_DELETE (flush) requests. Hits\nWARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined\ninto tcf_ct_act() in this build) within ~15s on the unpatched kernel;\nsame setup is clean on the patched kernel. The fix itself is\nbehavior-preserving: both branches already did `goto err_alloc`\nbefore and after, only the WARN is removed.", "A flaw was found in the Linux kernel's traffic control connection tracking subsystem. Under normal load or during connection tracking flushes, expected memory allocation failures inappropriately trigger a kernel warning. A local user can exploit this condition by racing connection flushes against network traffic, triggering a kernel panic and causing a Denial of Service (DoS) on systems configured to crash on kernel warnings."], "name": "CVE-2026-98622", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98622\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98622\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98622.mbox"], "threat_severity": "Moderate"}