CVE-2026-98320

A flaw was found in the Linux kernel's netfilter subsystem. In the flowtable component, connection tracking reference counts are prematurely released before flow entries are fully removed from memory. An attacker could exploit this timing issue during network flow processing, triggering a use-after-free condition. This issue primarily leads to a Denial of Service (DoS) via a system crash or unexpected system instability.

An Important severity use-after-free flaw was found in the Linux kernel's netfilter flowtable, affecting the kernel, kernel-rt, and kpatch packages in Red Hat Enterprise Linux 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift Container Platform through its RHEL CoreOS components. The flowtable datapath released its connection tracking reference prematurely: nf_ct_put() frees the ct extension area immediately, and the RCU typesafe semantics could allow the datapath to refer to the wrong or already-freed conntrack entry while a flow entry was still being released after the RCU grace period. An attacker able to trigger this timing window during network flow processing could cause a use-after-free condition that primarily results in a denial of service via a system crash or unexpected system instability. Red Hat rates this flaw with a CVSS 3.1 score of 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H), reflecting the high attack complexity of reliably triggering the timing issue, whereas the upstream CVEORG score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Red Hat Enterprise Linux 6 and 7 Extended Life Cycle Support streams (kernel and kernel-rt) are not affected because the vulnerable code is not present in those kernels. Fixes for the affected product streams are being pursued.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.