CVE-2026-74625
Received Received - Intake

Linux Kernel Memory Leak in Netfilter Bridge

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference. That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab. Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74625
EUVD
EUVD-2026-64562

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the netfilter bridge module. When a bridge nftables ct zone set rule attaches a conntrack template to a packet before nf_ct_bridge_pre() processes it, the system fails to release the template for non-IPv4 and non-IPv6 EtherTypes. This causes the template and temporary templates to become unreachable, leading to memory leaks until the host runs out of slab memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter bridge module and may not have direct detection commands. Monitor kernel logs for slab memory exhaustion or conntrack template leaks after bridge nftables ct zone rules are applied. Check for increased slab memory usage with commands like 'cat /proc/meminfo | grep Slab' or 'slabtop'. If memory issues are observed, inspect nftables rules with 'nft list ruleset'.

Impact Analysis

The vulnerability can cause system instability due to memory exhaustion. It may lead to crashes, degraded performance, or denial of service as the host runs out of available memory for other operations. Systems using bridge nftables ct zone set rules with non-IP traffic are particularly affected.

Mitigation Strategies

Apply the latest Linux kernel security updates to patch this issue. If immediate patching is not possible, avoid using bridge nftables ct zone set rules for non-IPv4/IPv6 EtherTypes. Temporarily disable or restrict nftables rules that may trigger this path until the kernel is updated.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74625. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart