In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF_FLOW_HW_PENDING to… (CVE-2026-98792)

The Linux kernel netfilter flowtable vulnerability (CVE-2026-98792) was addressed by renaming the NF_FLOW_HW_PENDING bit to NF_FLOW_PENDING and using it to prevent the flowtable garbage collection worker from running while hardware offload work is pending. This change prevents a race condition where nf_flow_offload_stats() could schedule work to retrieve statistics while the flow was being removed by the GC worker. Additionally, a previous commit reordering was reverted to avoid races between GC and the hardware offload handler. The patch ensures that GC is inhibited until flows are fully added or removed, maintaining flowtable consistency.

The vulnerability could lead to race conditions in the flowtable management, potentially causing inconsistent flow states or premature removal of flows during hardware offload operations. This could affect network packet processing reliability in the Linux kernel netfilter subsystem. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to address this issue. Users should update to the patched kernel versions containing this fix. Since this is a kernel-level vulnerability, applying the official kernel update from the vendor or distribution is the recommended remediation.