In the Linux kernel, the following vulnerability has been resolved: netfilter: nft_flow_offload: drop flowtable reference on init error path… (CVE-2026-98851)

The Linux kernel vulnerability (CVE-2026-98851) involves a reference leak in the nft_flow_offload_init() function of the netfilter subsystem. The function increments the flowtable use count before calling nf_ct_netns_get(). If nf_ct_netns_get() fails, the error is returned without decrementing the use count, causing a reference leak. Additionally, upper layers do not balance this leak because the expression destroy callbacks that would normally drop the reference are skipped when expression initialization fails. This results in flowtables that cannot be removed, as deletion attempts report -EBUSY despite no active references. The fix involves saving the return value of nf_ct_netns_get() and undoing the nft_use_inc() increment on failure, restoring proper reference count pairing within nft_flow_offload_init().

The vulnerability causes a resource leak in the Linux kernel's netfilter flowtable subsystem. This leak prevents flowtables from being properly removed, potentially leading to resource exhaustion or denial of service conditions where flowtables remain busy and cannot be deleted. There is no indication of code execution or privilege escalation from this issue.

A fix is available that corrects the reference counting logic in nft_flow_offload_init() by undoing the increment when nf_ct_netns_get() fails. Users should apply the official Linux kernel patch that addresses this reference leak to prevent flowtable removal failures. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation.