Tracking CVE-2026-98625 across Ubuntu kernel variants
Tracking CVE-2026-98625 across Ubuntu kernel variants Why one package row is not enough CVE-2026-98625 affects the Linux netfilter flowtable offload destroy path. Ubuntu's advisory lists many kernel package families, and their fixed versions do not move together. A host can run a kernel from a cloud, low-latency, real-time, or hardware-enablement line rather than the generic package an…
CVE-2026-98625 is a security vulnerability affecting the Linux netfilter flowtable offload destroy path. This issue varies across Ubuntu kernel variants, with the generic package showing different fixed versions than the HWE and specialized package rows. Ubuntu provides fixed versions for several cloud and appliance variants, but these may not all be updated.
The technical fix involves removing a dead-state publication from flow_offlow_work_del() and clearing NF_FLOW_HW_PENDING, applying smp_mb__before_atomic() for the destroy command, and then setting NF_FLOW_HW_DEAD. The race condition occurs when garbage collection frees the flow before the worker completes its final access. Administrators should collect the package owning the running kernel image, record its release, repository, and whether a reboot or live-patch is required.
It is essential to treat in-progress package rows as open items and not fixed, as the advisory indicates further fixes are coming. After installation, verify the running kernel to ensure the vulnerability has been addressed.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
