In the Linux kernel, the following vulnerability has been resolved: net/sched: act_ct: don't WARN on benign flow_offload_alloc() failure… (CVE-2026-98622)

The Linux kernel vulnerability CVE-2026-98622 concerns the net/sched act_ct module where flow_offload_alloc() can return NULL during expected conditions such as a dying conntrack entry or GFP_ATOMIC allocation failure. These conditions are benign and not bugs, but the kernel would WARN, which with panic_on_warn=1 could be exploited by an unprivileged user to cause a kernel panic by racing conntrack flushes against 'tc filter ... action ct commit' operations. The issue was reproducible under QEMU and fixed by removing the WARN while preserving existing error handling paths.

An unprivileged user can cause a denial of service by triggering a kernel panic through racing conntrack flush operations with traffic control actions, leading to system instability or downtime. There is no indication of privilege escalation or data corruption.

A fix has been applied to the Linux kernel that removes the WARN on benign flow_offload_alloc() failures, preventing kernel panics under the described conditions. Users should update to the patched kernel version when available. No additional mitigation is required as the fix is behavior-preserving and addresses the root cause.