CVE-2026-98622

In the Linux kernel, the following vulnerability has been resolved:

net/sched: act ct: don't WARN on benign flow offload alloc() failure

flow offload alloc() returns NULL when the conntrack entry is dying (e.g. raced with a conntrack flush) or when the GFP ATOMIC allocation fails; both are expected under load and neither is a kernel bug. This path runs from softirq on every committed packet, so with panic on warn=1 an unprivileged user can panic the box just by racing a conntrack flush against a tc ... action ct commit classifier.

Reproduced with a custom repro under QEMU: a small, fixed set of UDP flows through tc filter ... action ct commit on lo, raced against threads flooding bare ctnetlink CT DELETE (flush) requests. Hits WARNING: net/sched/act ct.c:437 (tcf ct flow table add(), inlined into tcf ct act() in this build) within ~15s on the unpatched kernel; same setup is clean on the patched kernel. The fix itself is behavior-preserving: both branches already did goto err alloc before and after, only the WARN is removed.