Vulnerabilities
Misconfiguration
Compliance
Cryptography
CVE Vulnerabilities

CVE-2026-98622

Published: Oct 18, 2026 | Modified: Oct 19, 2026
CVSS 3.x
N/A
Source:
NVD
CVSS 2.x
RedHat/V2
RedHat/V3
4.7 MODERATE
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Ubuntu
MEDIUM
Vulnerability-free packages from our partners
Additional information
NVDhttps://nvd.nist.gov/vuln/detail/CVE-2026-98622
CWEhttps://cwe.mitre.org/data/definitions/.html

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act_ct: dont WARN on benign flow_offload_alloc() failure

flow_offload_alloc() returns NULL when the conntrack entry is dying (e.g. raced with a conntrack flush) or when the GFP_ATOMIC allocation fails; both are expected under load and neither is a kernel bug. This path runs from softirq on every committed packet, so with panic_on_warn=1 an unprivileged user can panic the box just by racing a conntrack flush against a tc ... action ct commit classifier.

Reproduced with a custom repro under QEMU: a small, fixed set of UDP flows through tc filter ... action ct commit on lo, raced against threads flooding bare ctnetlink CT_DELETE (flush) requests. Hits WARNING: net/sched/act_ct.c:437 (tcf_ct_flow_table_add(), inlined into tcf_ct_act() in this build) within ~15s on the unpatched kernel; same setup is clean on the patched kernel. The fix itself is behavior-preserving: both branches already did goto err_alloc before and after, only the WARN is removed.

Affected Software

NameVendorStart VersionEnd Version
LinuxUbuntujammy*
LinuxUbuntunoble*
LinuxUbunturesolute*
LinuxUbuntuupstream*
Linux-allwinner-5.19Ubuntujammy*
Linux-allwinner-5.19Ubuntuupstream*
Linux-awsUbuntujammy*
Linux-awsUbuntunoble*
Linux-awsUbunturesolute*
Linux-awsUbuntuupstream*
Linux-aws-5.0Ubuntubionic*
Linux-aws-5.0Ubuntuesm-infra/bionic*
Linux-aws-5.0Ubuntuupstream*
Linux-aws-5.11Ubuntuesm-infra/focal*
Linux-aws-5.11Ubuntufocal*
Linux-aws-5.11Ubuntuupstream*
Linux-aws-5.13Ubuntuesm-infra/focal*
Linux-aws-5.13Ubuntufocal*
Linux-aws-5.13Ubuntuupstream*
Linux-aws-5.15Ubuntuesm-infra/focal*
Linux-aws-5.15Ubuntufocal*
Linux-aws-5.15Ubuntuupstream*
Linux-aws-5.19Ubuntujammy*
Linux-aws-5.19Ubuntuupstream*
Linux-aws-5.3Ubuntubionic*
Linux-aws-5.3Ubuntuesm-infra/bionic*
Linux-aws-5.3Ubuntuupstream*
Linux-aws-5.4Ubuntuupstream*
Linux-aws-5.8Ubuntuesm-infra/focal*
Linux-aws-5.8Ubuntufocal*
Linux-aws-5.8Ubuntuupstream*
Linux-aws-6.14Ubuntunoble*
Linux-aws-6.14Ubuntuupstream*
Linux-aws-6.17Ubuntunoble*
Linux-aws-6.17Ubuntuupstream*
Linux-aws-6.2Ubuntujammy*
Linux-aws-6.2Ubuntuupstream*
Linux-aws-6.5Ubuntujammy*
Linux-aws-6.5Ubuntuupstream*
Linux-aws-6.8Ubuntujammy*
Linux-aws-6.8Ubuntuupstream*
Linux-aws-7.0Ubuntunoble*
Linux-aws-7.0Ubuntuupstream*
Linux-aws-fipsUbuntufips-preview/jammy*
Linux-aws-fipsUbuntufips-updates/jammy*
Linux-aws-fipsUbuntufips-updates/noble*
Linux-aws-fipsUbuntuupstream*
Linux-aws-hweUbuntuupstream*
Linux-azureUbuntubionic*
Linux-azureUbuntuesm-infra/bionic*
Linux-azureUbuntujammy*
Linux-azureUbuntunoble*
Linux-azureUbunturesolute*
Linux-azureUbuntuupstream*
Linux-azure-4.15Ubuntuupstream*
Linux-azure-5.11Ubuntuesm-infra/focal*
Linux-azure-5.11Ubuntufocal*
Linux-azure-5.11Ubuntuupstream*
Linux-azure-5.13Ubuntuesm-infra/focal*
Linux-azure-5.13Ubuntufocal*
Linux-azure-5.13Ubuntuupstream*
Linux-azure-5.15Ubuntuesm-infra/focal*
Linux-azure-5.15Ubuntufocal*
Linux-azure-5.15Ubuntuupstream*
Linux-azure-5.19Ubuntujammy*
Linux-azure-5.19Ubuntuupstream*
Linux-azure-5.3Ubuntubionic*
Linux-azure-5.3Ubuntuesm-infra/bionic*
Linux-azure-5.3Ubuntuupstream*
Linux-azure-5.4Ubuntuupstream*
Linux-azure-5.8Ubuntuesm-infra/focal*
Linux-azure-5.8Ubuntufocal*
Linux-azure-5.8Ubuntuupstream*
Linux-azure-6.11Ubuntunoble*
Linux-azure-6.11Ubuntuupstream*
Linux-azure-6.14Ubuntunoble*
Linux-azure-6.14Ubuntuupstream*
Linux-azure-6.17Ubuntunoble*
Linux-azure-6.17Ubuntuupstream*
Linux-azure-6.2Ubuntujammy*
Linux-azure-6.2Ubuntuupstream*
Linux-azure-6.5Ubuntujammy*
Linux-azure-6.5Ubuntuupstream*
Linux-azure-6.8Ubuntujammy*
Linux-azure-6.8Ubuntuupstream*
Linux-azure-7.0Ubuntunoble*
Linux-azure-7.0Ubuntuupstream*
Linux-azure-edgeUbuntubionic*
Linux-azure-edgeUbuntuesm-infra/bionic*
Linux-azure-edgeUbuntuupstream*
Linux-azure-fdeUbuntuesm-infra/focal*
Linux-azure-fdeUbuntufocal*
Linux-azure-fdeUbuntunoble*
Linux-azure-fdeUbunturesolute*
Linux-azure-fdeUbuntuupstream*
Linux-azure-fde-5.15Ubuntuesm-infra/focal*
Linux-azure-fde-5.15Ubuntuupstream*
Linux-azure-fde-5.19Ubuntujammy*
Linux-azure-fde-5.19Ubuntuupstream*
Linux-azure-fde-6.14Ubuntunoble*
Linux-azure-fde-6.14Ubuntuupstream*
Linux-azure-fde-6.17Ubuntunoble*
Linux-azure-fde-6.17Ubuntuupstream*
Linux-azure-fde-6.2Ubuntujammy*
Linux-azure-fde-6.2Ubuntuupstream*
Linux-azure-fde-6.8Ubuntujammy*
Linux-azure-fde-6.8Ubuntuupstream*
Linux-azure-fde-7.0Ubuntunoble*
Linux-azure-fde-7.0Ubuntuupstream*
Linux-azure-fipsUbuntufips-preview/jammy*
Linux-azure-fipsUbuntufips-updates/jammy*
Linux-azure-fipsUbuntufips-updates/noble*
Linux-azure-fipsUbuntuupstream*
Linux-azure-nvidiaUbuntunoble*
Linux-azure-nvidiaUbuntuupstream*
Linux-azure-nvidia-6.14Ubuntunoble*
Linux-azure-nvidia-6.14Ubuntuupstream*
Linux-bluefieldUbuntubluefield/jammy*
Linux-bluefieldUbuntubluefield/noble*
Linux-bluefieldUbuntuesm-infra/focal*
Linux-bluefieldUbuntufocal*
Linux-bluefieldUbuntuupstream*
Linux-fipsUbuntufips-preview/jammy*
Linux-fipsUbuntufips-updates/jammy*
Linux-fipsUbuntufips-updates/noble*
Linux-fipsUbuntuupstream*
Linux-gcpUbuntubionic*
Linux-gcpUbuntuesm-infra/bionic*
Linux-gcpUbuntujammy*
Linux-gcpUbuntunoble*
Linux-gcpUbunturesolute*
Linux-gcpUbuntuupstream*
Linux-gcp-4.15Ubuntuupstream*
Linux-gcp-5.11Ubuntuesm-infra/focal*
Linux-gcp-5.11Ubuntufocal*
Linux-gcp-5.11Ubuntuupstream*
Linux-gcp-5.13Ubuntuesm-infra/focal*
Linux-gcp-5.13Ubuntufocal*
Linux-gcp-5.13Ubuntuupstream*
Linux-gcp-5.15Ubuntuesm-infra/focal*
Linux-gcp-5.15Ubuntufocal*
Linux-gcp-5.15Ubuntuupstream*
Linux-gcp-5.19Ubuntujammy*
Linux-gcp-5.19Ubuntuupstream*
Linux-gcp-5.3Ubuntubionic*
Linux-gcp-5.3Ubuntuesm-infra/bionic*
Linux-gcp-5.3Ubuntuupstream*
Linux-gcp-5.4Ubuntuupstream*
Linux-gcp-5.8Ubuntuesm-infra/focal*
Linux-gcp-5.8Ubuntufocal*
Linux-gcp-5.8Ubuntuupstream*
Linux-gcp-6.11Ubuntunoble*
Linux-gcp-6.11Ubuntuupstream*
Linux-gcp-6.14Ubuntunoble*
Linux-gcp-6.14Ubuntuupstream*
Linux-gcp-6.17Ubuntunoble*
Linux-gcp-6.17Ubuntuupstream*
Linux-gcp-6.2Ubuntujammy*
Linux-gcp-6.2Ubuntuupstream*
Linux-gcp-6.5Ubuntujammy*
Linux-gcp-6.5Ubuntuupstream*
Linux-gcp-6.8Ubuntujammy*
Linux-gcp-6.8Ubuntuupstream*
Linux-gcp-7.0Ubuntunoble*
Linux-gcp-7.0Ubuntuupstream*
Linux-gcp-fipsUbuntufips-preview/jammy*
Linux-gcp-fipsUbuntufips-updates/jammy*
Linux-gcp-fipsUbuntufips-updates/noble*
Linux-gcp-fipsUbuntuupstream*
Linux-gkeUbuntuesm-infra/focal*
Linux-gkeUbuntufocal*
Linux-gkeUbuntujammy*
Linux-gkeUbuntunoble*
Linux-gkeUbunturesolute*
Linux-gkeUbuntuupstream*
Linux-gkeUbuntuxenial*
Linux-gke-4.15Ubuntubionic*
Linux-gke-4.15Ubuntuesm-infra/bionic*
Linux-gke-4.15Ubuntuupstream*
Linux-gke-5.15Ubuntuesm-infra/focal*
Linux-gke-5.15Ubuntufocal*
Linux-gke-5.15Ubuntuupstream*
Linux-gke-5.4Ubuntubionic*
Linux-gke-5.4Ubuntuesm-infra/bionic*
Linux-gke-5.4Ubuntuupstream*
Linux-gkeopUbuntuesm-infra/focal*
Linux-gkeopUbuntufocal*
Linux-gkeopUbuntujammy*
Linux-gkeopUbuntunoble*
Linux-gkeopUbuntuupstream*
Linux-gkeop-5.15Ubuntuesm-infra/focal*
Linux-gkeop-5.15Ubuntufocal*
Linux-gkeop-5.15Ubuntuupstream*
Linux-gkeop-5.4Ubuntubionic*
Linux-gkeop-5.4Ubuntuesm-infra/bionic*
Linux-gkeop-5.4Ubuntuupstream*
Linux-hweUbuntubionic*
Linux-hweUbuntuesm-infra/bionic*
Linux-hweUbuntuupstream*
Linux-hwe-5.11Ubuntuesm-infra/focal*
Linux-hwe-5.11Ubuntufocal*
Linux-hwe-5.11Ubuntuupstream*
Linux-hwe-5.13Ubuntuesm-infra/focal*
Linux-hwe-5.13Ubuntufocal*
Linux-hwe-5.13Ubuntuupstream*
Linux-hwe-5.15Ubuntuesm-infra/focal*
Linux-hwe-5.15Ubuntufocal*
Linux-hwe-5.15Ubuntuupstream*
Linux-hwe-5.19Ubuntujammy*
Linux-hwe-5.19Ubuntuupstream*
Linux-hwe-5.4Ubuntuupstream*
Linux-hwe-5.8Ubuntuesm-infra/focal*
Linux-hwe-5.8Ubuntufocal*
Linux-hwe-5.8Ubuntuupstream*
Linux-hwe-6.11Ubuntunoble*
Linux-hwe-6.11Ubuntuupstream*
Linux-hwe-6.14Ubuntunoble*
Linux-hwe-6.14Ubuntuupstream*
Linux-hwe-6.17Ubuntunoble*
Linux-hwe-6.17Ubuntuupstream*
Linux-hwe-6.2Ubuntujammy*
Linux-hwe-6.2Ubuntuupstream*
Linux-hwe-6.5Ubuntujammy*
Linux-hwe-6.5Ubuntuupstream*
Linux-hwe-6.8Ubuntujammy*
Linux-hwe-6.8Ubuntuupstream*
Linux-hwe-7.0Ubuntunoble*
Linux-hwe-7.0Ubuntuupstream*
Linux-hwe-edgeUbuntubionic*
Linux-hwe-edgeUbuntuesm-infra-legacy/xenial*
Linux-hwe-edgeUbuntuesm-infra/bionic*
Linux-hwe-edgeUbuntuesm-infra/xenial*
Linux-hwe-edgeUbuntuupstream*
Linux-hwe-edgeUbuntuxenial*
Linux-ibmUbuntujammy*
Linux-ibmUbuntunoble*
Linux-ibmUbunturesolute*
Linux-ibmUbuntuupstream*
Linux-ibm-5.15Ubuntuesm-infra/focal*
Linux-ibm-5.15Ubuntufocal*
Linux-ibm-5.15Ubuntuupstream*
Linux-ibm-5.4Ubuntuupstream*
Linux-ibm-6.8Ubuntujammy*
Linux-ibm-6.8Ubuntuupstream*
Linux-intel-5.13Ubuntuesm-infra/focal*
Linux-intel-5.13Ubuntufocal*
Linux-intel-5.13Ubuntuupstream*
Linux-intel-iot-realtimeUbuntujammy*
Linux-intel-iot-realtimeUbunturealtime/jammy*
Linux-intel-iot-realtimeUbuntuupstream*
Linux-intel-iotgUbuntujammy*
Linux-intel-iotgUbuntuupstream*
Linux-intel-iotg-5.15Ubuntuesm-infra/focal*
Linux-intel-iotg-5.15Ubuntufocal*
Linux-intel-iotg-5.15Ubuntuupstream*
Linux-iotUbuntuupstream*
Linux-kvmUbuntujammy*
Linux-kvmUbuntuupstream*
Linux-lowlatencyUbuntujammy*
Linux-lowlatencyUbuntunoble*
Linux-lowlatencyUbuntuupstream*
Linux-lowlatency-hwe-5.15Ubuntuesm-infra/focal*
Linux-lowlatency-hwe-5.15Ubuntufocal*
Linux-lowlatency-hwe-5.15Ubuntuupstream*
Linux-lowlatency-hwe-5.19Ubuntujammy*
Linux-lowlatency-hwe-5.19Ubuntuupstream*
Linux-lowlatency-hwe-6.11Ubuntunoble*
Linux-lowlatency-hwe-6.11Ubuntuupstream*
Linux-lowlatency-hwe-6.2Ubuntujammy*
Linux-lowlatency-hwe-6.2Ubuntuupstream*
Linux-lowlatency-hwe-6.5Ubuntujammy*
Linux-lowlatency-hwe-6.5Ubuntuupstream*
Linux-lowlatency-hwe-6.8Ubuntujammy*
Linux-lowlatency-hwe-6.8Ubuntuupstream*
Linux-lts-xenialUbuntuupstream*
Linux-nvidiaUbuntujammy*
Linux-nvidiaUbuntunoble*
Linux-nvidiaUbunturesolute*
Linux-nvidiaUbuntuupstream*
Linux-nvidia-6.11Ubuntunoble*
Linux-nvidia-6.11Ubuntuupstream*
Linux-nvidia-6.17Ubuntunoble*
Linux-nvidia-6.17Ubuntuupstream*
Linux-nvidia-6.2Ubuntujammy*
Linux-nvidia-6.2Ubuntuupstream*
Linux-nvidia-6.5Ubuntujammy*
Linux-nvidia-6.5Ubuntuupstream*
Linux-nvidia-6.8Ubuntujammy*
Linux-nvidia-6.8Ubuntuupstream*
Linux-nvidia-7.0Ubuntunoble*
Linux-nvidia-7.0Ubuntuupstream*
Linux-nvidia-bosUbunturesolute*
Linux-nvidia-bosUbuntuupstream*
Linux-nvidia-lowlatencyUbuntunoble*
Linux-nvidia-lowlatencyUbuntuupstream*
Linux-nvidia-tegraUbuntujammy*
Linux-nvidia-tegraUbuntunoble*
Linux-nvidia-tegraUbuntuupstream*
Linux-nvidia-tegra-5.15Ubuntuesm-infra/focal*
Linux-nvidia-tegra-5.15Ubuntufocal*
Linux-nvidia-tegra-5.15Ubuntuupstream*
Linux-nvidia-tegra-igxUbuntujammy*
Linux-nvidia-tegra-igxUbuntuupstream*
Linux-oemUbuntubionic*
Linux-oemUbuntuesm-infra/bionic*
Linux-oemUbuntuupstream*
Linux-oemUbuntuxenial*
Linux-oem-5.10Ubuntuesm-infra/focal*
Linux-oem-5.10Ubuntufocal*
Linux-oem-5.10Ubuntuupstream*
Linux-oem-5.13Ubuntuesm-infra/focal*
Linux-oem-5.13Ubuntufocal*
Linux-oem-5.13Ubuntuupstream*
Linux-oem-5.14Ubuntuesm-infra/focal*
Linux-oem-5.14Ubuntufocal*
Linux-oem-5.14Ubuntuupstream*
Linux-oem-5.17Ubuntujammy*
Linux-oem-5.17Ubuntuupstream*
Linux-oem-5.6Ubuntuesm-infra/focal*
Linux-oem-5.6Ubuntufocal*
Linux-oem-5.6Ubuntuupstream*
Linux-oem-6.0Ubuntujammy*
Linux-oem-6.0Ubuntuupstream*
Linux-oem-6.1Ubuntujammy*
Linux-oem-6.1Ubuntuupstream*
Linux-oem-6.11Ubuntunoble*
Linux-oem-6.11Ubuntuupstream*
Linux-oem-6.14Ubuntunoble*
Linux-oem-6.14Ubuntuupstream*
Linux-oem-6.17Ubuntunoble*
Linux-oem-6.17Ubuntuupstream*
Linux-oem-6.5Ubuntujammy*
Linux-oem-6.5Ubuntuupstream*
Linux-oem-6.8Ubuntunoble*
Linux-oem-6.8Ubuntuupstream*
Linux-oem-7.0Ubunturesolute*
Linux-oem-7.0Ubuntuupstream*
Linux-oracleUbuntujammy*
Linux-oracleUbuntunoble*
Linux-oracleUbunturesolute*
Linux-oracleUbuntuupstream*
Linux-oracle-5.0Ubuntubionic*
Linux-oracle-5.0Ubuntuesm-infra/bionic*
Linux-oracle-5.0Ubuntuupstream*
Linux-oracle-5.11Ubuntuesm-infra/focal*
Linux-oracle-5.11Ubuntufocal*
Linux-oracle-5.11Ubuntuupstream*
Linux-oracle-5.13Ubuntuesm-infra/focal*
Linux-oracle-5.13Ubuntufocal*
Linux-oracle-5.13Ubuntuupstream*
Linux-oracle-5.15Ubuntuesm-infra/focal*
Linux-oracle-5.15Ubuntufocal*
Linux-oracle-5.15Ubuntuupstream*
Linux-oracle-5.3Ubuntubionic*
Linux-oracle-5.3Ubuntuesm-infra/bionic*
Linux-oracle-5.3Ubuntuupstream*
Linux-oracle-5.4Ubuntuupstream*
Linux-oracle-5.8Ubuntuesm-infra/focal*
Linux-oracle-5.8Ubuntufocal*
Linux-oracle-5.8Ubuntuupstream*
Linux-oracle-6.14Ubuntunoble*
Linux-oracle-6.14Ubuntuupstream*
Linux-oracle-6.17Ubuntunoble*
Linux-oracle-6.17Ubuntuupstream*
Linux-oracle-6.5Ubuntujammy*
Linux-oracle-6.5Ubuntuupstream*
Linux-oracle-6.8Ubuntujammy*
Linux-oracle-6.8Ubuntuupstream*
Linux-oracle-7.0Ubuntunoble*
Linux-oracle-7.0Ubuntuupstream*
Linux-raspiUbuntujammy*
Linux-raspiUbuntunoble*
Linux-raspiUbunturesolute*
Linux-raspiUbuntuupstream*
Linux-raspi-5.4Ubuntuupstream*
Linux-raspi-realtimeUbuntunoble*
Linux-raspi-realtimeUbunturealtime/noble*
Linux-raspi-realtimeUbuntuupstream*
Linux-raspi2Ubuntubionic*
Linux-raspi2Ubuntuesm-infra/focal*
Linux-raspi2Ubuntufocal*
Linux-raspi2Ubuntuupstream*
Linux-raspi2Ubuntuxenial*
Linux-realtimeUbuntujammy*
Linux-realtimeUbuntunoble*
Linux-realtimeUbunturealtime/jammy*
Linux-realtimeUbunturealtime/noble*
Linux-realtimeUbunturesolute*
Linux-realtimeUbuntuupstream*
Linux-realtime-6.14Ubunturealtime/noble*
Linux-realtime-6.14Ubuntuupstream*
Linux-realtime-6.17Ubunturealtime/noble*
Linux-realtime-6.17Ubuntuupstream*
Linux-realtime-6.8Ubunturealtime/jammy*
Linux-realtime-6.8Ubuntuupstream*
Linux-riscvUbuntuesm-infra/focal*
Linux-riscvUbuntufocal*
Linux-riscvUbuntujammy*
Linux-riscvUbuntunoble*
Linux-riscvUbunturesolute*
Linux-riscvUbuntuupstream*
Linux-riscv-5.11Ubuntuesm-infra/focal*
Linux-riscv-5.11Ubuntufocal*
Linux-riscv-5.11Ubuntuupstream*
Linux-riscv-5.15Ubuntuesm-infra/focal*
Linux-riscv-5.15Ubuntufocal*
Linux-riscv-5.15Ubuntuupstream*
Linux-riscv-5.19Ubuntujammy*
Linux-riscv-5.19Ubuntuupstream*
Linux-riscv-5.8Ubuntuesm-infra/focal*
Linux-riscv-5.8Ubuntufocal*
Linux-riscv-5.8Ubuntuupstream*
Linux-riscv-6.14Ubuntunoble*
Linux-riscv-6.14Ubuntuupstream*
Linux-riscv-6.17Ubuntunoble*
Linux-riscv-6.17Ubuntuupstream*
Linux-riscv-6.5Ubuntujammy*
Linux-riscv-6.5Ubuntuupstream*
Linux-riscv-6.8Ubuntujammy*
Linux-riscv-6.8Ubuntuupstream*
Linux-riscv-7.0Ubuntunoble*
Linux-riscv-7.0Ubuntuupstream*
Linux-starfive-5.19Ubuntujammy*
Linux-starfive-5.19Ubuntuupstream*
Linux-starfive-6.2Ubuntujammy*
Linux-starfive-6.2Ubuntuupstream*
Linux-starfive-6.5Ubuntujammy*
Linux-starfive-6.5Ubuntuupstream*
Linux-vmwareUbuntuupstream*
Linux-xilinxUbuntunoble*
Linux-xilinxUbuntuupstream*
Linux-xilinx-zynqmpUbuntujammy*
Linux-xilinx-zynqmpUbuntuupstream*

References

Aqua Security is the largest pure-play cloud native security company, providing customers the freedom to innovate and run their businesses with minimal friction. The Aqua Cloud Native Security Platform provides prevention, detection, and response automation across the entire application lifecycle to secure the build, secure cloud infrastructure and secure running workloads wherever they are deployed.
Copyright © 2026 Aqua Security Software Ltd.   Privacy Policy | Terms of Use