CVE-2026-80744

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf tables offload: suppress WARN ON ONCE for ENOMEM in abort path

In nft flow rule offload abort(), WARN ON ONCE(err) is triggered on every error during rollback, including -ENOMEM. Memory allocation failures are expected under low-memory conditions and do not indicate a kernel bug.

Trace for example: nft flow offload chain() // FLOW BLOCK BIND nft flow block chain() nft chain offload cmd() nft block offload cmd() ->ndo setup tc() nsim setup tc() flow block cb setup simple() flow block cb alloc() // fails to -ENOMEM

The warning was reproduced on the 5.10 stable kernel under memory pressure via fault injection, but the underlying bug exists in mainline as well, as demonstrated by the ENOMEM trace above. The following splat was triggered during nf tables transaction processing:

WARNING: CPU: 0 PID: 8567 at net/netfilter/nf tables offload.c:532 nft flow rule offload abort net/netfilter/nf tables offload.c:532 [inline] WARNING: CPU: 0 PID: 8567 at net/netfilter/nf tables offload.c:532 nft flow rule offload commit+0x971/0xcd0 net/netfilter/nf tables offload.c:591 Modules linked in: CPU: 0 PID: 8567 Comm: syz-executor.0 Not tainted 5.10.260-syzkaller #0 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 RIP: 0010:nft flow rule offload abort net/netfilter/nf tables offload.c:532 [inline] RIP: 0010:nft flow rule offload commit+0x971/0xcd0 net/netfilter/nf tables offload.c:591 Call Trace: nf tables commit+0x3bd/0x4bd0 net/netfilter/nf tables api.c:8604 nfnetlink rcv batch+0xb1e/0x1f20 net/netfilter/nfnetlink.c:509 nfnetlink rcv skb batch net/netfilter/nfnetlink.c:579 [inline] nfnetlink rcv+0x3b3/0x420 net/netfilter/nfnetlink.c:597 netlink unicast kernel net/netlink/af netlink.c:1314 [inline] netlink unicast+0x6cd/0xa00 net/netfilter/af netlink.c:1340 netlink sendmsg+0x906/0xe10 net/netfilter/af netlink.c:1919 sock sendmsg nosec net/socket.c:651 [inline] sock sendmsg+0x155/0x190 net/socket.c:663 sys sendmsg+0x705/0x870 net/socket.c:2379 sys sendmsg+0x100/0x170 net/socket.c:2433 sys sendmsg+0xe9/0x1c0 net/socket.c:2462 do syscall 64+0x33/0x40 arch/x86/entry/common.c:46 entry SYSCALL 64 after hwframe+0x67/0xd1

Change the condition to WARN ON ONCE(err && err != -ENOMEM) so that warnings are only emitted for unexpected errors. This aligns with the common kernel practice of not warning on -ENOMEM.

Found by Linux Verification Center (linuxtesting.org) with Syzkaller.