CVE-2026-98278

This is a low-impact flaw in the Linux kernel's netfilter flowtable offload path. A local user with network administration privileges (CAP_NET_ADMIN) can configure a routing loop in which the route to an IP tunnel's remote endpoint resolves back to the tunnel device itself. When a flowtable then tries to offload a flow through such a tunnel, dev_fill_forward_path() makes no progress and trips a WARN_ON_ONCE() warning instead of gracefully failing the walk. Under default Red Hat configurations the consequence is only a kernel warning and a failed flow offload; on systems configured to halt on warnings (for example with panic_on_warn) this can be turned into a local denial of service.

The vulnerable code, introduced by the flowtable IPIP receive software acceleration feature, is present only in Red Hat Enterprise Linux 10.3 and 10.4 and in the Red Hat In-Vehicle OS 2.0 and 2.1 kernel streams; earlier RHEL 6 through 9 streams, the other RHEL 10 minor streams, and the OpenShift RHEL CoreOS images do not contain the vulnerable code and are therefore not affected. For the affected streams the fix is deferred to a future planned update; the residual risk remains low because triggering the flaw requires CAP_NET_ADMIN privileges to deliberately create the misconfigured tunnel routing loop, the tunnel transmit paths already treat such loops as a transmission error, and default configurations only log a warning rather than crashing. Although the Red Hat CVSS:3.1 score of 5.5 (Moderate) reflects the worst-case availability impact on systems that panic on warnings, Red Hat assesses the overall impact as LOW because exploitation requires privileged local access plus a deliberate network misconfiguration.