SEPTEMBER 19, 2026
Live Feed
Back to database
Case File

CVE-2026-74695

HIGH · CVSS 7.5 EPSS 0.43%

Source: NVD + CISA KEV + EPSS · Published 2026-08-22 · Last synced 2026-09-18

CyberRota Analysis

AI-Generated

The vulnerability affects the Linux kernel's netfilter component, specifically in the handling of socket buffers (skbs) during flowtable offloading. An attacker could exploit this flaw to manipulate reference counts of destination entries, potentially leading to memory corruption or denial of service, as indicated by the triggered assertions. System administrators and developers managing Linux-based systems should prioritize this issue to ensure the integrity and stability of their networking components.

CVE
CVE-2026-74695
Severity
HIGH
CVSS
7.5
EPSS
0.43%
Linux

Original NVD Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps. Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset(): WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864 Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.