Operation on a Resource after Expiration or Release in Linux kernel - CVE-2026-98484

Vulnerability details

The vulnerability allows a local privileged user to disrupt nftables catchall rule matching and interfere with catchall element insertion and deletion.

The vulnerability exists due to improper handling of expired resources in nft_setelem_catchall_insert() and nft_setelem_catchall_deactivate() when processing catchall element insertion and deletion requests. A local privileged user can manipulate catchall elements with timeouts so that expired entries block reinsertion or are selected for deletion instead of fresh entries, causing catchall rules to stop matching or element management requests to behave incorrectly.

Stale entries remain until the user-tunable garbage collection interval elapses, potentially prolonging the failure for an arbitrarily long time.

Affected software

How to mitigate CVE-2026-98484

External References

• https://git.kernel.org/stable/c/12cf803edfffef96f6415f0b5dbc7ec88842ea0f
• https://git.kernel.org/stable/c/2f07da3881525f7cbfed1ced2796c71a201505b9
• https://git.kernel.org/stable/c/4fb8b1ccc475651e480e509de126bb9ce7f3cff9
• https://git.kernel.org/stable/c/5e20b39aa7844769a7a782484bc1a809ffbc513e
• https://git.kernel.org/stable/c/70194dc37670bd08e44b471389861cc01bd3a3c9

Related Security Bulletins

• Operation on a Resource after Expiration or Release in Linux kernel netfilter
• Ubuntu update for linux-oem-7.0
• Ubuntu update for linux, linux-aws, linux-gcp and more