CVE-2026-80744

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path

In nft_flow_rule_offload_abort(), WARN_ON_ONCE(err) is triggered on every

error during rollback, including -ENOMEM. Memory allocation failures are

expected under low-memory conditions and do not indicate a kernel bug.

Trace for example:

nft_flow_offload_chain() // FLOW_BLOCK_BIND

nft_flow_block_chain()

nft_chain_offload_cmd()

nft_block_offload_cmd()

->ndo_setup_tc()

nsim_setup_tc()

flow_block_cb_setup_simple()

flow_block_cb_alloc() // fails to -ENOMEM

The warning was reproduced on the 5.10 stable kernel under memory pressure

via fault injection, but the underlying bug exists in mainline as well,

as demonstrated by the ENOMEM trace above. The following splat was

triggered during nf_tables transaction processing:

WARNING: CPU: 0 PID: 8567 at net/netfilter/nf_tables_offload.c:532 nft_flow_rul

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References