SB2026102256 - Operation on a Resource after Expiration or Release in Linux kernel netfilter

Description

This security bulletin contains information about 1 vulnerability.

1) Operation on a Resource after Expiration or Release (CVE-ID: CVE-2026-98484)

CWE-ID: CWE-672 - Operation on a Resource after Expiration or Release

CVSSv4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local privileged user to disrupt nftables catchall rule matching and interfere with catchall element insertion and deletion.

The vulnerability exists due to improper handling of expired resources in nft_setelem_catchall_insert() and nft_setelem_catchall_deactivate() when processing catchall element insertion and deletion requests. A local privileged user can manipulate catchall elements with timeouts so that expired entries block reinsertion or are selected for deletion instead of fresh entries, causing catchall rules to stop matching or element management requests to behave incorrectly.

Stale entries remain until the user-tunable garbage collection interval elapses, potentially prolonging the failure for an arbitrarily long time.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/12cf803edfffef96f6415f0b5dbc7ec88842ea0f
• https://git.kernel.org/stable/c/2f07da3881525f7cbfed1ced2796c71a201505b9
• https://git.kernel.org/stable/c/4fb8b1ccc475651e480e509de126bb9ce7f3cff9
• https://git.kernel.org/stable/c/5e20b39aa7844769a7a782484bc1a809ffbc513e
• https://git.kernel.org/stable/c/70194dc37670bd08e44b471389861cc01bd3a3c9