Flowtable Reference Leak in Linux Kernel Affects Netfilter Products

CVE-2026-98851

What is CVE-2026-98851?

A vulnerability exists in the Linux kernel's netfilter component that causes a resource leak during the initialization of flow offload. Specifically, when the initialization of flow offload fails, a reference to the flowtable is not properly decremented. This results in a memory leak that prevents the flowtable from being removed even when no rules reference it, leading to ongoing resource consumption and potential system instability.

References