CVE-2026-74695
Received Received - Intake

Linux Kernel Netfilter Flowtable dst Reference Leak

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps. Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset(): WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864 Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74695
EUVD
EUVD-2026-64382

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the netfilter flowtable offload mechanism. When incoming network packets (skbs) pass through netfilter hooks, they may already have a reference-counted destination entry. The code incorrectly overwrites this existing entry without dropping the reference, causing a reference count leak. This triggers kernel warnings and potential instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter flowtable functionality. Detection requires checking kernel logs for warnings related to skb_dst_set_noref or nf_flow_offload_ip_hook. Monitor logs with: dmesg | grep -i 'WARNING\|nf_flow_offload_ip_hook\|skb_dst_set_noref'.

Impact Analysis

This vulnerability could lead to kernel warnings, crashes, or instability in systems using netfilter flowtable offload features. It may cause network connectivity issues or unexpected system behavior in affected Linux systems.

Mitigation Strategies

Apply the latest Linux kernel security updates. If immediate patching is not possible, disable netfilter flowtable offload features by setting nf_flowtable=0 in kernel parameters or unloading the nf_flow_table module. Reboot the system after changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart