Tracking CVE-2026-98625 across Ubuntu kernel variants
Why one package row is not enough
CVE-2026-98625 affects the Linux netfilter flowtable offload destroy path. Ubuntu's advisory lists many kernel package families, and their fixed versions do not move together. A host can run a kernel from a cloud, low-latency, real-time, or hardware-enablement line rather than the generic package an administrator expects.
The advisory reviewed here was last updated on 4 November 2026 after publication on 18 October 2026. Treat those dates as the state of that record, not as a permanent description of every repository.
Generic kernel status
For the generic linux package, the reviewed Ubuntu record lists 26.04 LTS as fixed in 7.0.0-42.42 and 22.04 LTS as fixed in 5.15.0-202.212. It lists 24.04 LTS as vulnerable work in progress in 6.8.0-148.148. Those rows are different from the HWE and specialized package rows.
USN-8961-1 covers several kernel packages and references the CVE among a larger set of fixes. An administrator should confirm that the installed package belongs to the affected update set and that the host has activated the new kernel.
Cloud and appliance variants
Ubuntu lists fixed versions for several AWS, GCP, Azure, Oracle, IBM, real-time, and low-latency packages while other rows remain in progress. The package names and release chains differ, so a spreadsheet that checks only the linux package can miss the kernel that actually runs.
Collect the package that owns the running kernel image. Record its release, the repository it came from, and whether a reboot or live-patch step is required. For managed appliances, request the vendor's fixed firmware rather than mapping a host kernel string to a guessed status.
The technical fix
The upstream commit removes the dead-state publication from flow_offload_work_del(). In flow_offload_work_handler(), it clears NF_FLOW_HW_PENDING, applies smp_mb__before_atomic() for the destroy command, and then sets NF_FLOW_HW_DEAD.
The race occurs when garbage collection frees the flow after dead-state publication but before the worker completes its final access. The worker has no RCU read lock or reference. The fix makes publication the final flow access by destroy work.
Patch the fleet in waves
First patch hosts with untrusted local workloads or active flowtable hardware offload. Next update remaining production kernels during approved maintenance windows. Treat in-progress package rows as open items, not as fixed because the advisory says a fix is coming.
After installation, verify the running kernel. A package update that has not been activated does not close the exposure. If a live patch is used, confirm that it covers this CVE and the relevant running kernel tasks.
Exposure is separate from distribution status
ZoomEye's product="Linux" query returned 3,138,407 matches. The CVE filter returned 0. The product match can help an inventory team find Linux assets, but it cannot identify an Ubuntu variant or a fixed package version. Use it to trigger queries against the asset inventory, not as a replacement for distribution records.
Remediation checklist
Confirm the running kernel package, compare it with the Ubuntu row for that exact variant, install the fixed version, reboot or activate the approved live patch, and record the result. Keep 24.04 LTS and other in-progress rows on a follow-up list until the advisory or repository shows a fixed package.
Restrict local networking control and unnecessary offload exposure while systems await maintenance. Those measures reduce reachability but do not remove the kernel race.
