In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: skip expired catchall elements on insert and delete… (CVE-2026-98484)

The vulnerability in the Linux kernel's netfilter nf_tables subsystem arises because nft_setelem_catchall_insert() only checks duplicates against active elements, while other lookup and dump functions skip expired elements. When a catchall element expires, it becomes invisible to userspace but still blocks re-insertion, causing requests with NLM_F_EXCL to fail with -EEXIST and others to silently do nothing. Similarly, the delete function may deactivate stale expired entries instead of fresh ones, leading to inconsistencies. The fix aligns all walks to consider only active and non-expired elements using a per-network namespace timestamp at transaction start, ensuring consistent behavior and proper garbage collection synchronization.

The vulnerability causes stale catchall elements with expired timeouts to persist invisibly in the kernel, blocking re-insertion of new elements and causing silent failures or errors in rule management. This may lead to catchall rules silently ceasing to match traffic for an arbitrarily long time until garbage collection removes the stale entries. The inconsistency between userspace visibility and kernel state can disrupt expected firewall or packet filtering behavior.

A fix has been implemented in the Linux kernel to address this issue by aligning the insert, delete, lookup, and dump operations to consistently skip expired catchall elements and properly manage garbage collection. Users should apply the official kernel updates that include this fix. Patch status is not explicitly stated in the provided data; therefore, check the vendor or Linux kernel advisory for the current remediation guidance.