CVE-2026-74746
Received Received - Intake

Linux Kernel Netfilter Flowtable Use-After-Free

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74746
EUVD
EUVD-2026-66576

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the netfilter flowtable component. It involves a race condition where garbage collection (GC) can observe and free a flow while another process is still inserting it. The issue occurs because the original-direction tuple is published first, making it visible to GC before the reply node is fully installed. This leads to a use-after-free condition that KASAN can detect.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter flowtable component. Detection requires checking kernel logs for KASAN reports related to slab-use-after-free in flowtable or rhashtable paths. Monitor dmesg or system logs for errors like 'slab-use-after-free read/write' in flowtable operations.

Impact Analysis

This vulnerability could allow an attacker to trigger a use-after-free condition in the Linux kernel's netfilter flowtable. This might lead to system crashes, memory corruption, or potentially privilege escalation if exploited. Systems using affected kernel versions with flowtable functionality enabled are at risk.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. Disable flowtable if not required by setting nf_flowtable to 0 in kernel parameters. Monitor kernel logs for flowtable-related errors post-update.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74746. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart