CVE Database›Document archive›CVE-2026-90062

CVE-2026-90062

kernel: netfilter: nf_tables: move hardware offload step after building the chain blob

Loading…

Severity

Low

Red Hat Product Security

5.5

CVSS 3.1

Review impact separately from score.

Published · September 17, 2026

Updated · October 13, 2026

Description

A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nf_tables component. This vulnerability occurs because the hardware offload step for network filtering rules is performed before the complete set of rules (chain blob) is built. This timing issue can lead to an inconsistent state where the rules enforced by the network interface card (NIC) differ from the software-defined rules. Such an inconsistency could potentially allow for unexpected network behavior or a bypass of security policies.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 5.5
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition