Executive brief
The Linux kernel's netfilter flowtable subsystem (used for efficient network packet processing) contains a race condition in flow insertion that can allow the garbage collector to observe and delete a partially-installed flow. This can cause kernel memory corruption and denial of service on systems performing stateful packet filtering or network address translation.
Technical details
The vulnerability is a use-after-free race condition in the netfilter flowtable's flow_offload_add() function in net/netfilter/nf_flow_table_core.c. The flaw occurs because nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries; when the original node is inserted first, the garbage collector can observe and free the flow while the reply node is still being inserted, leading to concurrent access to freed memory. The fix reorders the insertion to publish the reply node first and the original node last, ensuring GC never observes a partially installed flow. The issue is reachable via any code path that adds flows to the flowtable and is exploitable on systems with netfilter flowtable enabled, requiring no authentication or user interaction.
Affected products
- Linux Linux kernel All versions prior to fix (commit 2014ac62df9d45bb9a004a043e85df7be09ed780)
Timeline
- 2026-08-26: disclosed: CVE-2026-74746 published
- 2026-08-10: patched: Patch merged upstream (commit 2014ac62df9d45bb9a004a043e85df7be09ed780)
- 2026-08-23: patched: Patch backported to stable kernels (commit 0a00254585827f1695aa2700114af622ea754cfa)