CVE-2026-98320

Summary

The Linux kernel's netfilter flowtable implementation has a reference counting issue where connection tracking (ct) structures are released too early, potentially leading to use-after-free conditions when accessing stale data from the flowtable datapath. This can result in arbitrary code execution or system instability.

Exploitability

Exploitation requires local user access with specific kernel module interaction and precise timing to trigger the race condition, making it moderately difficult but possible to achieve remote code execution through kernel memory corruption.

Blast radius

If exploited, this vulnerability could affect any Linux system running with netfilter flowtables enabled, potentially leading to full system compromise or denial of service across network services relying on connection tracking.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Apply the kernel patch included in the 6.12.2 kernel release to fix the reference counting issue in the netfilter flowtable implementation.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.