CVE-2026-98622

A flaw was found in the Linux kernel's traffic control connection tracking subsystem. Under normal load or during connection tracking flushes, expected memory allocation failures inappropriately trigger a kernel warning. A local user can exploit this condition by racing connection flushes against network traffic, triggering a kernel panic and causing a Denial of Service (DoS) on systems configured to crash on kernel warnings.

This vulnerability is evaluated with Moderate impact because exploiting it requires local privileges, non-default kernel panic-on-warning settings, and active traffic control filters configured for connection tracking. By default, Red Hat Enterprise Linux does not enable panic-on-warn, meaning that the improper warning condition produces only a diagnostic traceback rather than terminating the operating system. Consequently, unprivileged local users cannot crash standard deployments, confining denial-of-service risks to environments explicitly configured to treat kernel warnings as fatal errors.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.