‹ Volver al listado

CVE-2026-98625

Estado: RecibidaSin puntuar—
Gravedad—Sin puntuar
Probabilidad de explotación0.21 %mayor que el 11 % de las CVE
Explotación activaNono figura en el catálogo de CISA
Exploit públicoNo conocidosin código público localizado

En el kernel de Linux se ha resuelto la siguiente vulnerabilidad:

netfilter: flowtable: publicar HW_DEAD después de que el worker termine

flow_offload_work_del() establece NF_FLOW_HW_DEAD antes de que el manejador del worker borre NF_FLOW_HW_PENDING. Una vez que un flujo está a la vez en HW_DYING y en HW_DEAD, una pasada concurrente de recolección de basura puede eliminarlo y programarlo para su liberación mediante RCU.

El worker de descarga no mantiene ni un bloqueo de lectura RCU ni una referencia al flujo. Si se expropia después de publicar HW_DEAD, la callback de RCU puede liberar el flujo antes de que el worker se reanude y borre HW_PENDING, lo que da lugar a un use-after-free.

Leer descripción completaMostrar menos

Mover la publicación de HW_DEAD al epílogo común del worker, después de borrar el bit pendiente, de modo que sea el último acceso al flujo por parte del trabajo de destrucción. Ordenar todos los accesos previos al flujo antes de publicar el bit que permite a la recolección de basura liberar el objeto.

Traducción automática del texto original de NVD (en inglés).

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días
0.21 %
Percentil entre todas las CVEs puntuadas
11
Fecha de la puntuación
20/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

Mostrar las 8 referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-98625",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "f92e8f39726ba68a7c42c6b7566be687c8161579",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "00e452a7ca9fda135ea3d04a11128d5088e354a8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "56f39c7d139bb76072efe2fb3dcafc13ba915ad8",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "e20701843032c438f879066a77ea85e361c6b999",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "b4f0f05dfbe836a171bff261f17d098a4d5461ea",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "b0ef9450e93f2adeb77593db14c2ac7c6c8f5060",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "f26652e99f519e6bd34f8a9b48fbb33c603585f2",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
              "lessThan": "d644b23afe1ef509c9961a6d84a093c2587edf02",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "5.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/netfilter/nf_flow_table_offload.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-10-18T16:17:15.513",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/00e452a7ca9fda135ea3d04a11128d5088e354a8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/56f39c7d139bb76072efe2fb3dcafc13ba915ad8",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b0ef9450e93f2adeb77593db14c2ac7c6c8f5060",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b4f0f05dfbe836a171bff261f17d098a4d5461ea",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/d644b23afe1ef509c9961a6d84a093c2587edf02",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e20701843032c438f879066a77ea85e361c6b999",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f26652e99f519e6bd34f8a9b48fbb33c603585f2",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/f92e8f39726ba68a7c42c6b7566be687c8161579",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: publish HW_DEAD after worker is done\n\nflow_offload_work_del() sets NF_FLOW_HW_DEAD before the work handler\nclears NF_FLOW_HW_PENDING. Once a flow is both HW_DYING and HW_DEAD, a\nconcurrent garbage collection pass can remove it and schedule it for RCU\nfreeing.\n\nThe offload worker holds neither an RCU read lock nor a reference to the\nflow. If it is preempted after publishing HW_DEAD, the RCU callback can\nfree the flow before the worker resumes and clears HW_PENDING, resulting\nin a use-after-free.\n\nMove HW_DEAD publication to the common worker epilogue after the pending\nbit is cleared, making it the final flow access by destroy work. Order all\npreceding flow accesses before publishing the bit that allows garbage\ncollection to free the object."
    }
  ],
  "lastModified": "2026-10-19T10:19:26.700",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}