CVE-2026-90062
kernel: netfilter: nf_tables: move hardware offload step after building the chain blob
Severity
LowRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 17, 2026
Updated · October 13, 2026
Description
A flaw was found in the Linux kernel's netfilter subsystem, specifically within the nf_tables component. This vulnerability occurs because the hardware offload step for network filtering rules is performed before the complete set of rules (chain blob) is built. This timing issue can lead to an inconsistent state where the rules enforced by the network interface card (NIC) differ from the software-defined rules. Such an inconsistency could potentially allow for unexpected network behavior or a bypass of security policies.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.5CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition