Executive brief
The Linux kernel's IP fragment reassembly subsystem contains a race condition in the fragment queue creation logic. An attacker can trigger a memory corruption condition by sending specially crafted fragmented network packets with specific timeout configurations, potentially causing denial of service or other memory safety violations on systems processing network traffic.
Technical details
The vulnerability exists in the inet_frag_create() function within the IP fragment reassembly code (net/ipv4/inet_fragment.c). The function originally armed the fragment reassembly timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is set to zero or negative, the timer can fire before the queue is published in the hash table. This causes the timer callback to mark the queue as complete and attempt to remove a node not yet present in the hash table, dropping an anticipated reference. The creation code then publishes the completed queue without restoring that reference, leaving a stale hash node. The fix reorders operations to publish the queue and arm the timer while holding the queue lock, ensuring timer expiry waits until the queue is visible and inet_frag_kill() can properly balance references. This affects all Linux kernels with the vulnerable fragment reassembly code.
Affected products
- Linux Linux kernel Multiple versions prior to fix (linux 2.6.11 through 7.2 affected)
Timeline
- 2026-08-22: disclosed: CVE-2026-74662 published
- 2026-08-27: patched: Fix merged into Linux kernel stable tree via commits 08a04d7bfb9c103432561aff8a62b6872e694a6a and others