CVE-2026-98851

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nft flow offload: drop flowtable reference on init error path

nft flow offload init() bumps the flowtable use count with nft use inc() before calling nf ct netns get(). When the latter fails, the error is returned as-is and the reference is leaked.

The upper layers do not balance it either: nf tables newexpr() clears expr->ops when the expression init callback fails, so the nft expr more() iteration in nft rule expr deactivate() and nf tables rule destroy() stops right before the failed expression and its ->destroy callback, which would drop the reference, never runs.

Each failed rule addition therefore leaks one flowtable reference and the flowtable can no longer be removed: NFT MSG DELFLOWTABLE keeps reporting -EBUSY even though no rule references it.

Save the nf ct netns get() return value and undo the nft use inc() when it fails, restoring the inc/dec pairing within nft flow offload init() itself.