CVE-2026-74492

Received Received - Intake

Heap-based Use-After-Free in Linux Kernel Netfilter IPSet

Publication date: 2026-08-15

Last updated on: 2026-08-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: do not update comments from kernel-side hash adds mtype_resize() copies comment pointers with memcpy(), not the comment objects themselves. During the window after an entry has been copied but before the table swap and backlog replay, the old table is still published for packet-side updates while the replacement-table entry already holds the same ip_set_comment_rcu pointer. If xt_SET --add-set ... --exist hits that old entry in this window, mtype_add() calls ip_set_init_comment() even though packet-side adds carry no comment payload. That call frees the shared comment through the old entry, so the replacement-table entry now holds a stale pointer. When the queued add is replayed on the new table, mtype_add() calls ip_set_init_comment() again and strlen() dereferences the stale pointer. Fix this in mtype_add() by skipping ip_set_init_comment() when ext->target marks a packet-side add. Userspace adds still update comments, while packet-side adds can no longer free comment storage shared with a resize copy.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-19

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74492

EUVD

EUVD-2026-59685

Affected Vendors & Products

Vendor	Product	Version / Range
netfilter	ipset	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel's netfilter ipset module involves a race condition during table resizing. When an entry is copied during a resize operation, a shared comment pointer is temporarily duplicated. If a packet-side update occurs during this window, it can free the shared comment, leaving a stale pointer in the new table. Later, when the queued update is replayed, it attempts to access the freed memory, causing a use-after-free flaw.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter ipset module. Detection requires checking the kernel version and ipset module for the affected code. Use commands like 'uname -a' to check kernel version and 'lsmod | grep ip_set' to verify ipset module loading. No direct detection commands are provided in the context.

Impact Analysis

This flaw could allow an attacker to trigger a kernel crash or execute arbitrary code with kernel privileges. Systems using ipset for network filtering, especially those processing untrusted packets, are at risk. The impact includes potential denial-of-service or unauthorized system access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a memory corruption issue in the Linux kernel's netfilter subsystem. Compliance impacts would depend on the specific implementation and use case of the affected component.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves this issue. Check your distribution's security updates or kernel patches released after 2026-08-15. Avoid using ipset with comment features until patched.

Hi! I’m here to help you understand CVE-2026-74492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70