Executive brief
The Linux kernel's netfilter packet filtering system has a race condition in its hardware offload feature for network interface card (NIC) acceleration. The vulnerability allows hardware and software filtering rules to become out of sync during ruleset updates, potentially causing network traffic to be processed inconsistently or bypass intended security policies.
Technical details
The vulnerability is a state inconsistency issue in the nf_tables hardware offload commit path. The nft_flow_rule_offload_commit() function was being called before the chain blob (in-memory ruleset representation) was fully allocated, creating a window where the NIC's offloaded ruleset and the kernel's software ruleset could diverge. An attacker with CAP_NET_ADMIN privileges (able to modify firewall rules) could trigger this race condition by performing rapid ruleset modifications. The fix reorders operations to allocate the chain blob before offloading, ensuring atomic state consistency. Network reachability is not required; privilege to modify netfilter rules is the precondition. A patch is available in Linux kernel stable branches.
Affected products
- Linux Linux kernel multiple versions with netfilter nf_tables hardware offload support (approximately 4.14+)
Timeline
- 2026-09-17: disclosed
- 2026-08-13: patched: Fix committed upstream