CVE-2026-98792
En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad:
netfilter: flowtable: generalizar el bit de estado pendiente
Se renombra NF_FLOW_HW_PENDING a NF_FLOW_PENDING y se usa para inhibir el worker de GC de la flowtable hasta que se haya completado el trabajo pendiente de descarga en hardware (hw offload).
Al parecer, nf_flow_offload_stats() puede programar trabajo para recuperar estadísticas mientras el flujo está siendo eliminado por el GC.
Además, este bit puede usarse en un parche posterior para deshabilitar el GC hasta que el flujo se haya añadido completamente en ambas direcciones.
Leer descripción completaMostrar menos
Se revierte la reordenación realizada en el commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") para evitar una condición de carrera entre el GC y el manejador de descarga en hardware.
Traducción automática del texto original de NVD (en inglés).
CVSS
NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días
- 0.17 %
- Percentil entre todas las CVEs puntuadas
- 6
- Fecha de la puntuación
- 20/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.
Referencias
Mostrar las 4 referencias
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-98792",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
"lessThan": "4d52b72f3aa68ad0536444e36530bda75070194c",
"versionType": "git"
},
{
"status": "affected",
"version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
"lessThan": "4033e1a9262c57dfbfc594a591a50fcba63c531a",
"versionType": "git"
},
{
"status": "affected",
"version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
"lessThan": "a2cac45848d1cf31ed190db30f90ba8211e9a8ca",
"versionType": "git"
},
{
"status": "affected",
"version": "2c8897953f3b2ff5498f3f275708a742bfcdbc24",
"lessThan": "7c549fb7eecd01fdba7c0d12c01da876ef8a3214",
"versionType": "git"
}
],
"programFiles": [
"include/net/netfilter/nf_flow_table.h",
"net/netfilter/nf_flow_table_core.c",
"net/netfilter/nf_flow_table_offload.c",
"net/sched/act_ct.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.12.113",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.56",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"include/net/netfilter/nf_flow_table.h",
"net/netfilter/nf_flow_table_core.c",
"net/netfilter/nf_flow_table_offload.c",
"net/sched/act_ct.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:33.183",
"references": [
{
"url": "https://git.kernel.org/stable/c/4033e1a9262c57dfbfc594a591a50fcba63c531a",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/4d52b72f3aa68ad0536444e36530bda75070194c",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a2cac45848d1cf31ed190db30f90ba8211e9a8ca",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: flowtable: generalize pending status bit\n\nRename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the\nflowtable GC worker until pending hw offload work has been completed.\n\nApparently, nf_flow_offload_stats() can schedule work to retrieve stats\nwhile the flow is being removed by GC.\n\nAnd this bit can also be used in a follow up patch to disable GC until\nthe flow has been fully added in both directions.\n\nRevert the reordering done in commit d644b23afe1e (\"netfilter:\nflowtable: publish HW_DEAD after worker is done\") to prevent a race\nbetween GC and hw offload handler."
}
],
"lastModified": "2026-10-19T10:19:43.223",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}