{"cve":"CVE-2026-98622","nvd":{"published":"2026-10-18T16:17:15.117","modified":"2026-10-19T10:19:26.330","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: act_ct: don't WARN on benign flow_offload_alloc() failure\n\nflow_offload_alloc() returns NULL when the conntrack entry is dying\n(e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation\nfails; both are expected under load and neither is a kernel bug. This\npath runs from softirq on every committed packet, so with\npanic_on_warn=1 an unprivileged user can panic the box just by racing\na conntrack flush against a `tc ... action ct commit` classifier.\n\nReproduced with a custom repro under QEMU: a small, fixed set of UDP\nflows through `tc filter ... action ct commit` on lo, raced against\nthreads flooding bare ctnetlink CT_DELETE (flush) requests. Hits\nWARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined\ninto tcf_ct_act() in this build) within ~15s on the unpatched kernel;\nsame setup is clean on the patched kernel. The fix itself is\nbehavior-preserving: both branches already did `goto err_alloc`\nbefore and after, only the WARN is removed.","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/00734f3684fcec42c319bedfe68a5d357c720b53","https://git.kernel.org/stable/c/424ba52c0058deeb940d02cba52eb0aeb288db33","https://git.kernel.org/stable/c/47abe7a5c4eb53269aca3506446f851572a059a3","https://git.kernel.org/stable/c/650787233c2fd6e515a7c5f371019a9fa080ccd2","https://git.kernel.org/stable/c/af475f599270e59313552e6c6f3af8507da672b8"],"products":[],"source":"nvd","synced_at":"2026-10-19T23:00:53.604569364+00:00"},"epss":{"cve":"CVE-2026-98622","score":0.00177,"percentile":0.07156,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}