# netfilter: flowtable: hold reference on ct until flow is released

CVE record · `CVE-2026-98320`

- **Identifiers:** `CVE-2026-98320`
- **State:** Confirmed
- **Severity:** CVSS 7.8 High
- **Critical:** No
- **CNA:** Linux
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 6 Oct 2026
- **Updated:** 19 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 6 Oct 2026, 08:46 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 93ff1594be1aad4da364462dd8db050ebcfda2de` (git)
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before eed6997e8dc40593a539fcc722e7ed51b18db86c` (git)
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 61c6688be282277c6e91ab286a7acd0ae8681ac6` (git)
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before a43cd2b67b91e943273c913237a7a88c50cdcfbc` (git)
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 8274cdc5f9c57e17ed77fc4ba76212536c840f25` (git)
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 12c1ac230f4ca16e0017b62a963ab75e0b48074f` (git)
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before d9e6175a3ee48209ee65f294fc567b4e16b29b74` (git)
  - affected: `0ff90b6c20340e57616a51ae1a1bf18156d6638a to before e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.16`
  - unaffected: `before 4.16` (semver)
  - unaffected: `5.10.271 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.222 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.189 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.158 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.112 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.54 to 6.18.*, inclusive` (semver)
  - unaffected: `7.2.8 to 7.2.*, inclusive` (semver)
  - unaffected: `7.3 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from CNA (Linux)

- **CISA KEV:** Not listed.
- **EPSS:** 0.0014, the 3rd percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 6 Oct 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-98320](https://www.cve.org/CVERecord?id=CVE-2026-98320)
- [NVD: CVE-2026-98320](https://nvd.nist.gov/vuln/detail/CVE-2026-98320)

### References from the CNA

- <https://git.kernel.org/stable/c/93ff1594be1aad4da364462dd8db050ebcfda2de>
- <https://git.kernel.org/stable/c/eed6997e8dc40593a539fcc722e7ed51b18db86c>
- <https://git.kernel.org/stable/c/61c6688be282277c6e91ab286a7acd0ae8681ac6>
- <https://git.kernel.org/stable/c/a43cd2b67b91e943273c913237a7a88c50cdcfbc>
- <https://git.kernel.org/stable/c/8274cdc5f9c57e17ed77fc4ba76212536c840f25>
- <https://git.kernel.org/stable/c/12c1ac230f4ca16e0017b62a963ab75e0b48074f>
- <https://git.kernel.org/stable/c/d9e6175a3ee48209ee65f294fc567b4e16b29b74>
- <https://git.kernel.org/stable/c/e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-98320>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-98320/>. Everything for agents: <https://agentprime.io/llms.txt>.