Skip to main content

Linux Kernel CVE-2026-90062

| EUVDEUVD-2026-81923 HIGH
2026-09-17 Linux GHSA-7p55-3fjg-254h
Linux Red Hat Netfilter
High
Disputed · 7.1 Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Gain local CAP_NET_ADMIN context
  2. Delivery
    Submit nftables ruleset with hardware offload
  3. Exploit
    Induce chain-blob allocation failure on commit
  4. Execution
    Offloaded NIC ruleset diverges from software ruleset
  5. Impact
    Firewall policy inconsistency (bypass or traffic loss)

Vulnerability Assessment

Exploitation Conditions

Requires local access with CAP_NET_ADMIN (per PR:L) to program nftables rulesets, plus the nf_tables hardware-offload feature enabled on an offload-capable NIC (flower/tc-offload). The inconsistent state is reached only when the chain-blob allocation fails during ruleset commit after the offload step has already executed - an error/resource-pressure path, not a straightforward always-on trigger. Limiting factors: no remote vector (AV:L), privileged capability needed, dependence on offload-capable hardware and on hitting an allocation failure, and the defensive nature of the fix ('reduce chances') indicating a narrow, non-deterministic window.
Impact

This is a Linux kernel netfilter/nf_tables hardware-offload consistency bug where the offload step executed before the chain blob was allocated, so a failure allocating the blob could leave the NIC-offloaded ruleset and the in-kernel software ruleset in divergent states. The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, 7.1) correctly reflects a local, low-privilege issue with no confidentiality impact but integrity and availability consequences (firewall policy divergence). There is no EPSS score, no CISA KEV listing, and no public exploit identified, so this is a real-but-low-priority defect rather than an actively exploited threat. Two signals warrant scrutiny: (1) the AC:L rating is arguably optimistic - the commit is defensive ('reduce chances of entering an inconsistent state'), meaning the inconsistency is reachable only when the chain-blob allocation fails on the offload error path, which is closer to AC:H; and (2) the input Tag 'Information Disclosure' directly conflicts with the CVSS C:N (no confidentiality impact), so the tag is mislabeled and should not drive triage. Exploitation also requires CAP_NET_ADMIN to program nftables with hardware offload, further limiting practical risk to already-privileged local contexts.
Exploit ScenarioDerived

A local user or container holding CAP_NET_ADMIN configures an nftables ruleset with hardware offload enabled on an offload-capable NIC and induces (e.g., via memory pressure) a chain-blob allocation failure during commit. The offload step, having already run, leaves the NIC enforcing a ruleset that differs from the intended software ruleset, so packets may be filtered or passed inconsistently. No public exploit code is identified, and triggering requires hitting the allocation error path at the right moment.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 18, 2026

Netfilter nf_tables in the Linux kernel performed the hardware-offload step before allocating the chain blob during ruleset commits, so an allocation failure at that point could leave the NIC-offloaded ruleset diverging from the in-kernel software ruleset. Affected are Linux kernel builds with nf_tables hardware offload enabled on an offload-capable NIC; the fix landed in stable releases 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 and 7.2.6/7.3-rc1, and the bug traces back to code introduced in the 5.3 series. Exploitation requires local access with CAP_NET_ADMIN and an error/resource-pressure path, so no public exploit has been identified at time of analysis.

RemediationAI

Apply the vendor patch by upgrading to a fixed kernel: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.110, 6.18.52 or 7.2.6 (7.3-rc1 also contains the fix), which correspond to the stable commits published at https://git.kernel.org/stable/c/923f824f30faebc5560c3061a595063cecdbdbb8, https://git.kernel.org/stable/c/6e7ad6e69be4751ab2476042c70c600bdaa8d4f2, https://git.kernel.org/stable/c/309acbab74e46114246bf4346c9b60b3d8cb4fcd, https://git.kernel.org/stable/c/79eafe22ab0a650996da2b3e5d94a12c3e16f3aa, https://git.kernel.org/stable/c/52febaf1d311d6ede312b2ec7692a309714f9554, https://git.kernel.org/stable/c/d5497644329d3a01e951aba76561bbd883ff6b0c, https://git.kernel.org/stable/c/6a7d3b074cfbb64513f5f92d60ab1b216ae98076 and https://git.kernel.org/stable/c/b1881d362e1924b66f6016c3efd28807032b41bf, with distribution advisories tracked under https://nvd.nist.gov/vuln/detail/CVE-2026-90062. Where immediate kernel upgrades are not possible, the direct compensating control is to stop using nf_tables hardware offload: omit the nft offload flag when committing rulesets and ensure no chain has the offload attribute set, which removes the NIC/software divergence condition entirely at the cost of losing NIC-accelerated filtering performance; an alternative is to constrain the attack surface by withholding CAP_NET_ADMIN from untrusted users and disabling unprivileged user namespaces, since that capability is the prerequisite for programming rulesets at all, though this breaks legitimate container and namespace tooling that relies on it. Monitoring for netlink/netfilter commit failures under memory pressure can also flag the error path that precedes the inconsistent state.

Affected VersionsENISA

Linux patch: 6.12.110
Linux c9626a2cbdb20e26587b3fad99960520a023432b <309acbab74e46114246bf4346c9b60b3d8cb4fcd
Linux patch: 6.18.52
Linux patch: 0
Linux c9626a2cbdb20e26587b3fad99960520a023432b <79eafe22ab0a650996da2b3e5d94a12c3e16f3aa
Linux c9626a2cbdb20e26587b3fad99960520a023432b <d5497644329d3a01e951aba76561bbd883ff6b0c
Linux c9626a2cbdb20e26587b3fad99960520a023432b <6e7ad6e69be4751ab2476042c70c600bdaa8d4f2
Linux c9626a2cbdb20e26587b3fad99960520a023432b <6a7d3b074cfbb64513f5f92d60ab1b216ae98076
Linux c9626a2cbdb20e26587b3fad99960520a023432b <923f824f30faebc5560c3061a595063cecdbdbb8
Linux c9626a2cbdb20e26587b3fad99960520a023432b <52febaf1d311d6ede312b2ec7692a309714f9554
Linux patch: 5.10.270
Linux 5.3
Linux patch: 5.15.221
Linux patch: 6.6.157
Linux patch: 7.2.6
Linux c9626a2cbdb20e26587b3fad99960520a023432b <b1881d362e1924b66f6016c3efd28807032b41bf
Linux patch: 6.1.188
Linux patch: 7.3-rc1

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The vulnerability lives in the netfilter nf_tables subsystem, the in-kernel packet-filtering framework driven by the nft(8) userspace tool. nf_tables supports offloading rulesets to NIC hardware via the flower classifier and tc offload path, where each chain is serialized into a 'chain blob' that is pushed down to the network device. The defective ordering committed the offload to the NIC before the chain blob was successfully allocated, so if that allocation failed the commit could abort while the hardware still held the previously offloaded ruleset, producing a split-brain state between the NIC datapath and the software ruleset in the kernel. No CWE was assigned in the CVE record, but the pattern corresponds to a race/inconsistent-state condition (CWE-362) combined with improper handling of an allocation-failure exceptional path (CWE-754). The upstream fix simply reorders the flow so the chain blob is built before the offload step, which the commit message describes as reducing (not eliminating) the chance of divergence; the affected CPE is cpe:2.3:a:linux:linux, i.e. mainline and stable Linux kernel trees rather than a downstream distribution package.

Know when Netfilter gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Sources disagree (Low–High)
Vendor (Linux) PRIMARY 7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI 6.3 MEDIUM

Local CAP_NET_ADMIN config gives PR:L; inconsistency needs a blob-allocation failure on the offload error path so AC:H; firewall-policy divergence yields I:H/A:H with no disclosure (C:N).

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 1.9 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N
Red Hat 5.5 LOW

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 18, 2026 - 18:22 NVD
7.1 (HIGH)
Patch available
Sep 17, 2026 - 17:19 EUVD
CVE Published
Sep 17, 2026 - 16:05 cve.org
HIGH 7.1
CVE Published
Sep 17, 2026 - 16:05 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables: move hardware offload step after building the chain blob

Allocate the chain blob before the ruleset offload to reduce chances of entering an inconsistent state where the offloaded ruleset in the nic and the software ruleset differ.

Executive ViewAI

Why It Matters

A flaw in the Linux kernel's nf_tables hardware offload feature can cause the network interface card's offloaded firewall rules to diverge from the kernel's software ruleset when an allocation failure occurs during ruleset commits, potentially leading to security policy bypass or network inconsistency. Organizations running affected kernels with nf_tables hardware offload enabled on offload-capable NICs are exposed, though exploitation requires local access with CAP_NET_ADMIN and a specific error condition. No public exploit identified at time of analysis.

Business Impact: Medium
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 88% exploitable
Prevalence
High
Linux kernel is ubiquitous but the nf_tables hardware-offload path needs an offload-capable NIC
Data Quality
5 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Defer
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
Medium

Priority Score

36
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +36
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

More in Netfilter

View all
CVE-2015-6496 MEDIUM POC
5.0 Aug 24

conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using
CVE-2019-11360 MEDIUM POC
4.2 Jul 12

A buffer overflow in iptables-restore in netfilter iptables 1.8.2 allows an attacker to (at least) crash the program or

CVE-2026-90237 HIGH
7.8 Sep 17

Memory-safety corruption in the Linux kernel's netfilter nft_ct conntrack expectation code lets a local user with CAP_NE
CVE-2012-2663 HIGH
7.5 Feb 15

extensions/libxt_tcp.c in iptables through 1.4.21 does not match TCP SYN+FIN packets in --syn rules, which might allow r
CVE-2026-97608 HIGH
7.0 Sep 25

Linux kernel netfilter logging (the nf_log_syslog and nfnetlink_log backends) contains a teardown-ordering race that lea
CVE-2026-97609 HIGH
7.0 Sep 25

A use-after-free race in the Linux kernel's nfnetlink_cttimeout netfilter module lets a local attacker who holds CAP_NET

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-90062 ADVISORY https://ubuntu.com/security/notices/USN-8959-1 ADVISORY https://ubuntu.com/security/notices/USN-8960-1 ADVISORY https://ubuntu.com/security/notices/USN-8961-1 ADVISORY https://ubuntu.com/security/notices/USN-8962-1 ADVISORY https://ubuntu.com/security/notices/USN-8963-1 ADVISORY https://vuldb.com/vuln/406545 REF https://git.kernel.org/stable/c/309acbab74e46114246bf4346c9b60b3d8cb4fcd REF https://git.kernel.org/stable/c/52febaf1d311d6ede312b2ec7692a309714f9554 REF https://git.kernel.org/stable/c/6a7d3b074cfbb64513f5f92d60ab1b216ae98076 REF https://git.kernel.org/stable/c/6e7ad6e69be4751ab2476042c70c600bdaa8d4f2 REF https://git.kernel.org/stable/c/79eafe22ab0a650996da2b3e5d94a12c3e16f3aa REF https://git.kernel.org/stable/c/923f824f30faebc5560c3061a595063cecdbdbb8 REF https://git.kernel.org/stable/c/b1881d362e1924b66f6016c3efd28807032b41bf REF https://git.kernel.org/stable/c/d5497644329d3a01e951aba76561bbd883ff6b0c

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy