Vulnerability-Lookup

CVE-2026-74695 (GCVE-0-2026-74695)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41

Title

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps. Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset(): WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864 Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Assigner

Linux mitre root

References

3 references

URL	Tags
https://git.kernel.org/stable/c/12afa450a6a6c0cce…
https://git.kernel.org/stable/c/538e67e8c7889cf5f…
https://git.kernel.org/stable/c/8aecf0bbcc7260559…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 , < 12afa450a6a6c0cce2c42b7545a9958f62d8a00c (git) Affected: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 , < 538e67e8c7889cf5f93951f5309d1bcb41f86036 (git) Affected: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 , < 8aecf0bbcc72605592134c917c222207d8f63ab0 (git) Affected: b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27 (git) Affected: 209dedf806d31095968f54323dbe62525b077b33 (git) Affected: 4.16.15 , < 4.17 (semver) Affected: 4.17.1 , < 4.18 (semver)	guessed
Linux	Linux	Affected: 4.18 Unaffected: 0 , < 4.18 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12afa450a6a6c0cce2c42b7545a9958f62d8a00c",
              "status": "affected",
              "version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
              "versionType": "git"
            },
            {
              "lessThan": "538e67e8c7889cf5f93951f5309d1bcb41f86036",
              "status": "affected",
              "version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
              "versionType": "git"
            },
            {
              "lessThan": "8aecf0bbcc72605592134c917c222207d8f63ab0",
              "status": "affected",
              "version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "209dedf806d31095968f54323dbe62525b077b33",
              "versionType": "git"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.15",
              "versionType": "semver"
            },
            {
              "lessThan": "4.18",
              "status": "affected",
              "version": "4.17.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.16.15",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "4.17.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n  WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n  WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n  WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb-\u003e_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:38.836Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
        },
        {
          "url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
        },
        {
          "url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
        }
      ],
      "title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74695",
    "datePublished": "2026-08-22T15:32:57.756Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:38.836Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74695",
      "date": "2026-08-27",
      "epss": "0.00426",
      "percentile": "0.35434"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:46:57.000Z",
      "cve": "CVE-2026-74695",
      "id": "msrc_CVE-2026-74695",
      "initial_release_date": "2026-08-24T01:03:29.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74695.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74695\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:44.050\",\"lastModified\":\"2026-08-25T06:18:53.000\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\\n\\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\\noffload path) might already carry a ref-counted dst_entry assigned during\\nearlier RX or routing steps.\\n\\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\\nskb_dst_check_unset():\\n\\n  WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\\n  WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\\n  WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\\n\\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\\nsetting the non-referenced flowtable destination.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_flow_table_ip.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2a79fd3908acd88e6cb0e620c314d7b1fee56a02\",\"lessThan\":\"12afa450a6a6c0cce2c42b7545a9958f62d8a00c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a79fd3908acd88e6cb0e620c314d7b1fee56a02\",\"lessThan\":\"538e67e8c7889cf5f93951f5309d1bcb41f86036\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2a79fd3908acd88e6cb0e620c314d7b1fee56a02\",\"lessThan\":\"8aecf0bbcc72605592134c917c222207d8f63ab0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"209dedf806d31095968f54323dbe62525b077b33\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"4.16.15\",\"lessThan\":\"4.17\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"4.17.1\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_flow_table_ip.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:54:28+00:00",
      "cve": "CVE-2026-74695",
      "id": "CVE-2026-74695",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74695.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-74695

Vulnerability from fkie_nvd - Published: 2026-08-22 16:16 - Updated: 2026-08-25 06:18

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "12afa450a6a6c0cce2c42b7545a9958f62d8a00c",
              "status": "affected",
              "version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
              "versionType": "git"
            },
            {
              "lessThan": "538e67e8c7889cf5f93951f5309d1bcb41f86036",
              "status": "affected",
              "version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
              "versionType": "git"
            },
            {
              "lessThan": "8aecf0bbcc72605592134c917c222207d8f63ab0",
              "status": "affected",
              "version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "209dedf806d31095968f54323dbe62525b077b33",
              "versionType": "git"
            },
            {
              "lessThan": "4.17",
              "status": "affected",
              "version": "4.16.15",
              "versionType": "semver"
            },
            {
              "lessThan": "4.18",
              "status": "affected",
              "version": "4.17.1",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_flow_table_ip.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.18"
            },
            {
              "lessThan": "4.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n  WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n  WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n  WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination."
    }
  ],
  "id": "CVE-2026-74695",
  "lastModified": "2026-08-25T06:18:53.000",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-22T16:16:44.050",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-CX4H-XJM7-PQXP

Vulnerability from github – Published: 2026-08-22 18:30 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps.

Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset():

WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864

Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74695"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-22T16:16:44Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n  WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n  WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n  WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination.",
  "id": "GHSA-cx4h-xjm7-pqxp",
  "modified": "2026-08-25T06:31:28Z",
  "published": "2026-08-22T18:30:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74695"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-74695

Vulnerability from csaf_microsoft - Published: 2026-08-24 01:03 - Updated: 2026-08-24 14:46

Summary

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74695

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74695.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
    "tracking": {
      "current_release_date": "2026-08-24T14:46:57.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.280Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74695",
      "initial_release_date": "2026-08-24T01:03:29.000Z",
      "revision_history": [
        {
          "date": "2026-08-24T01:03:29.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:46:57.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74695",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74695.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-24T01:03:29.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74695 (GCVE-0-2026-74695)

FKIE_CVE-2026-74695

GHSA-CX4H-XJM7-PQXP

MSRC_CVE-2026-74695

Tags

Sightings

Nomenclature