CVE-2026-74347

Received Received - Intake

Refcount-Based Memory Management Flaw in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf_ct_timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used by a conntrack entry. When the last conntrack entry drops the refcount on the ct timeout, the ct timeout is released. Remove the refcount for control plane which controls if the ruleset refers to the timeout policy. After this update, it is possible to remove the ct timeout policy from nfnetlink_cttimeout immediately. This is for simplicity not to handle two refcounts on a single object. Remove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just hold a reference to the nf_ct_timeout object until packet is reinjected, since this is part of the ct extension, this will be released by the time the conntrack is freed. nf_ct_untimeout() is still called to clean up in a best effort basis: the ct timeout on existing entries gets removed when the ct timeout goes away, but as long as the iptables ruleset still refers to the ct timeout through a template, new conntracks may keep attaching it and extend its lifetime until the rule is removed. nf_ct_untimeout() is not called anymore from module removal path, this is unlikely to find timeouts give module refcount is bumped, and the new refcount already tracks the ct timeout policy use so it is released when unused.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74347

EUVD

EUVD-2026-59494

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	linux_kernel	*
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a refcount mechanism for the nf_ct_timeout structure used in connection tracking timeout policies. The issue simplifies management by removing a separate control plane refcount, allowing immediate removal of timeout policies from nfnetlink_cttimeout. This change may lead to unexpected behavior where timeout policies are released prematurely if not properly tracked by conntrack entries.

Detection Guidance

This CVE describes a Linux kernel vulnerability related to netfilter timeout policy management. Detection requires checking kernel logs for netfilter-related errors or unexpected behavior in timeout policy handling. Use commands like dmesg | grep -i netfilter or journalctl -k | grep -i timeout to inspect kernel logs for anomalies.

Impact Analysis

If exploited, this vulnerability could cause network disruptions by prematurely terminating valid connection timeout policies. Systems relying on custom timeout rules for traffic management may experience unexpected packet drops or misrouted connections. Administrators might lose control over timeout configurations, affecting firewall and NAT operations.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to internal kernel memory management and timeout policy handling in the Linux netfilter subsystem. No evidence suggests data exposure or unauthorized access risks that would impact regulatory compliance.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor kernel logs for any signs of timeout policy misuse or crashes. If using custom timeout policies, review and update iptables rules to ensure proper cleanup.

Hi! I’m here to help you understand CVE-2026-74347. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70