CVE-2026-98851 netfilter: nft_flow_offload: drop flowtable reference on init error path

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: drop flowtable reference on init error path nftflowoffloadinit bumps the flowtable use count with nftuseinc before calling nfctnetnsget. When the latter fails, the error is returned as-is and the...

CVE-2026-98851

The Linux kernel contains a vulnerability in netfilter: nft_flow_offload where nft_flow_offload_init() incorrectly handles reference counting. The function increments the flowtable use count using nft_use_inc() but fails to decrement it if the subsequent nf_ct_netns_get() call fails. Because uppe...

EUVD-2026-103791

In the Linux kernel, the following vulnerability has been resolved: netfilter: nftflowoffload: drop flowtable reference on init error path nftflowoffloadinit bumps the flowtable use count with nftuseinc before calling nfctnetnsget. When the latter fails, the error is returned as-is and the...