In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish HW_DEAD after worker is done… (CVE-2026-98625)

The vulnerability in the Linux kernel's netfilter flowtable arises because flow_offload_work_del() sets the NF_FLOW_HW_DEAD flag before the work handler clears the NF_FLOW_HW_PENDING flag. This ordering allows a concurrent garbage collection pass to remove and schedule the flow for RCU freeing while the offload worker does not hold an RCU read lock or reference. If the worker is preempted after publishing HW_DEAD, the flow can be freed before the worker clears HW_PENDING, causing a use-after-free condition. The fix moves the publication of HW_DEAD to after the pending bit is cleared, ensuring all flow accesses complete before the object can be freed.

This use-after-free vulnerability could lead to kernel memory corruption, potentially causing system instability or crashes. However, there is no indication of known exploits in the wild or direct impact beyond the use-after-free condition as described.

A fix has been implemented in the Linux kernel that changes the order of flag updates to prevent premature freeing of flow objects. Users should apply the official kernel updates that include this fix once available. Patch status is not yet confirmed in the provided data; check the vendor advisory for current remediation guidance.