HIGH Introduced in 5.3
netfilter NFTables Offload Race
CVE-2026-90062
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
KernelScan AI5.5MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_tables: move hardware offload step after building the chain blob Allocate the chain blob before the ruleset offload to reduce chances of entering an inconsistent state where the offloaded ruleset in the nic and the software ruleset differ.
02KernelScan AI Analysis
Risk summary
A local attacker with CAP_NET_ADMIN (obtainable in a user namespace) can trigger a race condition in the netfilter nf_tables hardware offload commit path, leading to an inconsistent state between the NIC's offloaded ruleset and the software ruleset. This can result in a kernel panic or denial of service.
Vulnerability analysis
During the nf_tables commit process, hardware offload was applied before the software chain blob was fully allocated and prepared. If the offload step failed or was interrupted, the hardware state could diverge from the software ruleset, leaving the system in an inconsistent state that could lead to a crash or denial of service. The fix moves the hardware offload step to after the chain blob allocation, ensuring the software ruleset is fully prepared before hardware is programmed, and adds cleanup logic to cancel the chain preparation and audit data if the offload fails. This vulnerability is reachable by a local attacker with CAP_NET_ADMIN, which can be obtained in a user namespace on many configurations.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.3 | 6.1.188 | 309acbab74e4 |
| 6.6 | 5.3 | 6.6.157 | 79eafe22ab0a |
| 6.12 | 5.3 | 6.12.110 | 52febaf1d311 |
| 7.2 | 5.3 | 7.2.6 | 6a7d3b074cfb |
| mainline | 5.3 | 7.3-rc1 | b1881d362e19 |
| 5.15 | 5.3 | 5.15.221 | 6e7ad6e69be4 |
| 5.10 | 5.3 | 5.10.270 | 923f824f30fa |
| 6.18 | 5.3 | 6.18.52 | d5497644329d |
| cip/6.12 | 5.3 | 6.12.111-cip32 | 52febaf1d311 |