Executive brief
The Linux kernel's netfilter bridge module contains a memory leak in connection tracking template handling for non-IP traffic. When processing network frames that are not IPv4 or IPv6, the code failed to properly release existing connection tracking references before marking the frame as untracked, causing memory to accumulate until the system exhausts available slab memory and becomes unstable or crashes.
Technical details
The vulnerability is a resource leak in the netfilter bridge connection tracking module (nf_ct_bridge_pre function). When nftables bridge rules attach a conntrack template to a socket buffer (skb) for non-IP EtherTypes, the kernel code would overwrite the skb->_nfct field with IP_CT_UNTRACKED without first releasing the existing template reference. This left per-CPU and temporary conntrack templates unreachable and permanently allocated. The fix adds an explicit nf_reset_ct(skb) call before marking the frame untracked on the non-IP path to properly decrement template references. The vulnerability affects systems using bridge netfilter rules with connection tracking on non-IP protocols and is exploitable through normal network traffic processing without requiring authentication or special privileges.
Affected products
- Linux Linux kernel All versions from introduction by commit 3c171f496ef5 up to and including 2026-07-31
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched