Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

CVE record · CVE-2026-98320

netfilter: flowtable: hold reference on ct until flow is released

CVSS 7.8 HighEPSS 0.0014 · 3rd percentile

Published by the CVE Program (CNA: Linux) at 6 Oct 2026, 08:46 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

Affected products, as the CNA wrote them
VendorProductVersions
Linux Linux
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 93ff1594be1aad4da364462dd8db050ebcfda2de git
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before eed6997e8dc40593a539fcc722e7ed51b18db86c git
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 61c6688be282277c6e91ab286a7acd0ae8681ac6 git
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before a43cd2b67b91e943273c913237a7a88c50cdcfbc git
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 8274cdc5f9c57e17ed77fc4ba76212536c840f25 git
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before 12c1ac230f4ca16e0017b62a963ab75e0b48074f git
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before d9e6175a3ee48209ee65f294fc567b4e16b29b74 git
  • affected 0ff90b6c20340e57616a51ae1a1bf18156d6638a to before e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d git
Other versions: unaffected
Linux Linux
  • affected 4.16
  • unaffected before 4.16 semver
  • unaffected 5.10.271 to 5.10.*, inclusive semver
  • unaffected 5.15.222 to 5.15.*, inclusive semver
  • unaffected 6.1.189 to 6.1.*, inclusive semver
  • unaffected 6.6.158 to 6.6.*, inclusive semver
  • unaffected 6.12.112 to 6.12.*, inclusive semver
  • unaffected 6.18.54 to 6.18.*, inclusive semver
  • unaffected 7.2.8 to 7.2.*, inclusive semver
  • unaffected 7.3 to *, inclusive original_commit_for_fix
Other versions: affected
Identifiers
CVE-2026-98320
CNA
Linux
Tags
Published
6 Oct 2026
Updated
19 Oct 2026

Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

Severity and exploitation

ScoreRatingCVSSVectorSource
7.8 High 3.1 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CNA (Linux)
  • CISA KEV Not listed.
  • EPSS 0.0014, the 3rd percentile, on 10 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

This record came from the full history of the CVE Program, published 6 Oct 2026. New records show when each source confirmed them.

Sources

References from the CNA

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.