Executive brief
The Linux kernel's netfilter flow table offload mechanism has a memory leak where incoming network packets that already carry routing information have their previous reference count leaked when the flow table attempts to assign a new destination. This can cause memory leaks and trigger kernel warnings, potentially degrading system stability and performance on systems using netfilter flow table acceleration.
Technical details
A memory leak vulnerability exists in net/netfilter/nf_flow_table_ip.c where the nf_flow_offload_ip_hook() and nf_flow_offload_ipv6_hook() functions call skb_dst_set_noref() without first dropping any existing reference-counted dst_entry. When incoming skbs from RX or routing steps already carry a ref-counted dst_entry, overwriting it with skb_dst_set_noref() leaks the previous dst_entry reference count and triggers DEBUG_NET_WARN_ON_ONCE assertions. The fix adds skb_dst_drop(skb) calls before skb_dst_set_noref() in the affected code paths. This is a local vulnerability affecting systems with netfilter flowtable offload or XFRM offload enabled, requiring no network access or special privileges.
Affected products
- Linux Linux kernel 5.0 and later (specific affected versions in stable series 4.19.y, 5.4.y, 5.10.y, 5.15.y, 6.1.y, 6.6.y and others)
Timeline
- 2026-08-22: disclosed: Public disclosure via NVD
- 2026-08-04: patched: Upstream fix committed by Eric Dumazet