CVE-2026-74748
Received Received - Intake

Use-After-Free in Linux Kernel Netfilter IPSet

Publication date: 2026-08-26

Last updated on: 2026-08-26

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -> ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets. Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap() already does, keeping the refcount tied to the index rather than to a stale set pointer. kernel BUG at net/netfilter/ipset/ip_set_core.c:685! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870) Call Trace: <IRQ> list_set_del (net/netfilter/ipset/ip_set_list_set.c:159) set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181) list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578) call_timer_fn (kernel/time/timer.c:1748) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374) run_timer_softirq (kernel/time/timer.c:2405) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-26
Last Modified
2026-08-26
Generated
2026-08-26
AI Q&A
2026-08-26
EPSS Evaluated
N/A
NVD
CVE-2026-74748
EUVD
EUVD-2026-66578

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
netfilter ipset *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a race condition vulnerability in the Linux kernel's netfilter ipset module. It occurs when the reference count of an IP set is decremented incorrectly due to concurrent operations. Specifically, a garbage collection process (list_set_gc) and a swap operation (ip_set_swap) can interfere with each other, causing the kernel to attempt to decrement a reference count that has already reached zero. This leads to a kernel panic and system crash.

Detection Guidance

This vulnerability is specific to the Linux kernel's netfilter ipset module and may cause kernel panics. Detection requires checking kernel logs for oops or panic messages related to ip_set_put_byindex or list_set_gc. Commands: dmesg | grep -i 'ip_set_put_byindex\|list_set_gc\|kernel BUG' or journalctl -k | grep -i 'ip_set_put_byindex\|list_set_gc\|kernel BUG'.

Impact Analysis

This vulnerability can cause a denial of service by crashing the affected system. If exploited, it results in a kernel panic and system reboot, leading to downtime and potential data loss. Systems using the ipset module for network filtering are particularly at risk.

Mitigation Strategies

Apply the kernel patch that resolves the refcount race in ipset. Update to a patched kernel version. If immediate patching is not possible, disable the ipset module temporarily with modprobe -r ip_set or block related operations until the fix is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74748. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart