After patching CVE-2026-98625, verify the kernel not just the package
The update is not complete at installation
CVE-2026-98625 is a Linux netfilter flowtable use-after-free fixed by changing when destroy work publishes NF_FLOW_HW_DEAD. Installing a kernel package can place the fixed image on disk while the system continues to run the old kernel.
The closure criterion should be a verified running kernel, not a successful package transaction. This is especially important on systems with deferred reboots, multiple boot entries, image-based updates, or live-patch products.
Check the running release
Record the running kernel release and match it to the package or image that contains the fix. For Ubuntu, check the exact package row for the installed variant. The reviewed advisory lists 26.04 LTS generic as fixed in 7.0.0-42.42 and 22.04 LTS generic as fixed in 5.15.0-202.212, while 24.04 LTS generic remained vulnerable work in progress.
Cloud images and appliance devices may use a different kernel package family. Confirm the image lineage and the boot artifact. Do not infer a fix from a generic host package that is not the active kernel.
Inspect the source when possible
The upstream fix removes the early dead-bit write from flow_offload_work_del(). The common work handler clears NF_FLOW_HW_PENDING, applies smp_mb__before_atomic() for FLOW_CLS_DESTROY, and then publishes NF_FLOW_HW_DEAD.
For a custom kernel or backport, inspect those three elements. A fixed-looking version label does not prove that a local branch preserved the barrier and the command condition.
Validate the active configuration
Determine whether flowtable hardware offload is enabled and used. A generic product scan cannot answer that question. Review network policy, drivers, and workload role. Systems that run untrusted local network control deserve earlier confirmation than fixed appliances with no reachable path.
Test representative flow creation and deletion after boot. The test should not be used as proof that the race is impossible. Its value is operational: it shows that the intended kernel starts, loads the needed modules, and handles normal teardown.
Handle live patches carefully
A live-patch system can leave the running release unchanged while modifying kernel functions in memory. Confirm that the live patch covers CVE-2026-98625 or the equivalent source change and that it applies to the active task set.
If the live patch does not cover this fix, schedule the normal reboot into the patched image. If the patch state is uncertain, keep the host open rather than treating the package as sufficient evidence.
Use exposure data correctly
The verified ZoomEye search for product="Linux" returned 3,138,407 matches. The CVE filter returned 0. The product count can help locate Linux assets and prioritize inventory checks. It does not confirm vulnerability, patch state, or active offload.
Keep the exposure figure in the context section of an asset review. Use the running kernel and package evidence for closure.
Rollout records
For each host or image, record the detected kernel, installed package, fixed version or patch, reboot or live-patch evidence, and the reason any exception remains open. For appliance vendors, record the fixed firmware and the confirmation that the affected flowtable code was corrected.
This record supports future audits. It also prevents a common failure mode: a package database says fixed while an older recovery image or boot entry remains the one that starts.
Remediation and monitoring
Apply the vendor update, activate the fixed kernel, and verify the active release. Restrict local access and unnecessary offload workloads while an exception remains. Monitor crashes and kernel memory safety reports because CVE-2026-98625 can produce use-after-free consequences without a unique application log signature.
The final evidence should establish that the host is running supported kernel code with the corrected lifetime ordering, not merely that an update command completed.
