GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74660 (GCVE-0-2026-74660)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
netfilter: ebt_nflog: pin the NFLOG backend
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: ebt_nflog: pin the NFLOG backend nf_log_unregister() runs after the per-net teardown so its final RCU grace period also drains readers that obtained the logger from a per-net binding. However, ebt_nflog passes an explicit ULOG log type to nf_log_packet() without holding a reference on the selected logger module, unlike the xt_NFLOG and nft_log frontends. An ebtables nflog rule can therefore remain callable while nfnetlink_log is unloaded. The resulting interleaving is: CPU 0 CPU 1 nfnetlink_log_fini() unregister_pernet_subsys() kfree(nfnl_log_pernet(net)) ebt_nflog_tg() nf_log_packet() nfulnl_log_packet() instance_lookup_get_rcu() The global ULOG logger is still registered at this point, so CPU 1 dereferences the per-net state after CPU 0 has freed it. KASAN reported: BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu Read of size 8 at addr ff110001052e6210 by task poc/92 Call Trace: instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log] nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log] nf_log_packet+0x204/0x300 ebt_nflog_tg+0x351/0x550 ebt_do_table+0xedf/0x22b0 Allocated by task 90: __kmalloc_noprof+0x186/0x470 ops_init+0x6d/0x420 register_pernet_operations+0x2f6/0x670 register_pernet_subsys+0x23/0x40 Freed by task 93: kfree+0x131/0x3c0 ops_undo_list+0x3e3/0x700 unregister_pernet_operations+0x232/0x490 unregister_pernet_subsys+0x1c/0x30 nfnetlink_log_fini+0x34/0x450 [nfnetlink_log] Acquire the ULOG logger module reference when an ebt_nflog rule is validated and release it when the rule is destroyed. Request the NFLOG backend for legacy callers when needed, matching xt_NFLOG. This prevents module teardown until all ebt_nflog rules have stopped using the logger.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 3bcce49d617c593c7606083bfdb464a1761fa68d (git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 394d7939c6b2b9e6bea0844c89efb5913168d898 (git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 2cac4294f184c9bc19ff82552c62b80498694c39 (git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 9d8a94b48b393885e7f876c8ef68ed4da5012078 (git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 6809379a860b9fccbb5435bf08343f6d081ac68d (git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb (git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < e2ab7e878bdbe80104c879c31fd2d82a476703b8 (git)
Affected: c83fa19603bdaeef17b815713dbbe3230c8a34ee , < 30825970339c107bacaf7f61af90fcdb1f597ca1 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebt_nflog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3bcce49d617c593c7606083bfdb464a1761fa68d",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            },
            {
              "lessThan": "394d7939c6b2b9e6bea0844c89efb5913168d898",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            },
            {
              "lessThan": "2cac4294f184c9bc19ff82552c62b80498694c39",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            },
            {
              "lessThan": "9d8a94b48b393885e7f876c8ef68ed4da5012078",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            },
            {
              "lessThan": "6809379a860b9fccbb5435bf08343f6d081ac68d",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            },
            {
              "lessThan": "47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            },
            {
              "lessThan": "e2ab7e878bdbe80104c879c31fd2d82a476703b8",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            },
            {
              "lessThan": "30825970339c107bacaf7f61af90fcdb1f597ca1",
              "status": "affected",
              "version": "c83fa19603bdaeef17b815713dbbe3230c8a34ee",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/bridge/netfilter/ebt_nflog.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: ebt_nflog: pin the NFLOG backend\n\nnf_log_unregister() runs after the per-net teardown so its final RCU\ngrace period also drains readers that obtained the logger from a per-net\nbinding.  However, ebt_nflog passes an explicit ULOG log type to\nnf_log_packet() without holding a reference on the selected logger module,\nunlike the xt_NFLOG and nft_log frontends.\n\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log\nis unloaded.  The resulting interleaving is:\n\n  CPU 0                               CPU 1\n  nfnetlink_log_fini()\n    unregister_pernet_subsys()\n      kfree(nfnl_log_pernet(net))\n                                      ebt_nflog_tg()\n                                        nf_log_packet()\n                                          nfulnl_log_packet()\n                                            instance_lookup_get_rcu()\n\nThe global ULOG logger is still registered at this point, so CPU 1\ndereferences the per-net state after CPU 0 has freed it.  KASAN reported:\n\n  BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu\n  Read of size 8 at addr ff110001052e6210 by task poc/92\n  Call Trace:\n   instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\n   nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\n   nf_log_packet+0x204/0x300\n   ebt_nflog_tg+0x351/0x550\n   ebt_do_table+0xedf/0x22b0\n  Allocated by task 90:\n   __kmalloc_noprof+0x186/0x470\n   ops_init+0x6d/0x420\n   register_pernet_operations+0x2f6/0x670\n   register_pernet_subsys+0x23/0x40\n  Freed by task 93:\n   kfree+0x131/0x3c0\n   ops_undo_list+0x3e3/0x700\n   unregister_pernet_operations+0x232/0x490\n   unregister_pernet_subsys+0x1c/0x30\n   nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\n\nAcquire the ULOG logger module reference when an ebt_nflog rule is\nvalidated and release it when the rule is destroyed.  Request the NFLOG\nbackend for legacy callers when needed, matching xt_NFLOG.  This prevents\nmodule teardown until all ebt_nflog rules have stopped using the logger."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The UAF is reached through ebtables setsockopt rule installation and nfnetlink_log module teardown (local administrative paths); per kernel CNA guidance, netfilter/ebtables bugs are scored Local even when bridge hook evaluation can be driven by forwarded frames.\nAC:L - The KASAN reproducer uses a deterministic two-thread race between nfnetlink_log_fini() module removal and concurrent bridge traffic through an active ebt_nflog rule; the attacker controls both the unload timing and packet generation without depending on uncontrollable victim state.\nPR:L - Installing an ebt_nflog rule requires CAP_NET_ADMIN in the socket network namespace, obtainable by unprivileged users via user+network namespaces (unshare -Urn); the documented PoC races module teardown concurrently with rule-driven traffic, matching standard CNA treatment for ebtables/netfilter paths.\nUI:N - No victim interaction is required beyond the attacker\u0027s own ebtables configuration, module unload coordination, and bridge traffic generation to hit the active nflog target during the teardown window.\nS:U - The slab use-after-free corrupts host kernel memory within the same security authority; this is not a VM escape, container breakout across an IOMMU boundary, or other cross-scope privilege transition.\nC:H - KASAN confirmed a slab use-after-free read in instance_lookup_get_rcu() against freed nfnl_log_pernet state; UAF on the per-net instance hash table enables attacker-influenced heap reads and disclosure of adjacent kernel memory contents.\nI:H - Use-after-free on the nfnl_log_pernet structure and nfulnl_instance objects provides standard heap grooming primitives; freed slab reuse can redirect subsequent logging operations into attacker-controlled data for arbitrary kernel writes or control-flow hijack.\nA:H - The UAF read on freed per-net logging state can immediately trigger a kernel BUG/oops (as reported by KASAN) and reliably causes denial of service; repeated bridge traffic during module teardown can panic the affected host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:14.285Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3bcce49d617c593c7606083bfdb464a1761fa68d"
        },
        {
          "url": "https://git.kernel.org/stable/c/394d7939c6b2b9e6bea0844c89efb5913168d898"
        },
        {
          "url": "https://git.kernel.org/stable/c/2cac4294f184c9bc19ff82552c62b80498694c39"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d8a94b48b393885e7f876c8ef68ed4da5012078"
        },
        {
          "url": "https://git.kernel.org/stable/c/6809379a860b9fccbb5435bf08343f6d081ac68d"
        },
        {
          "url": "https://git.kernel.org/stable/c/47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2ab7e878bdbe80104c879c31fd2d82a476703b8"
        },
        {
          "url": "https://git.kernel.org/stable/c/30825970339c107bacaf7f61af90fcdb1f597ca1"
        }
      ],
      "title": "netfilter: ebt_nflog: pin the NFLOG backend",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74660",
    "datePublished": "2026-08-22T15:32:33.677Z",
    "dateReserved": "2026-08-15T05:44:03.924Z",
    "dateUpdated": "2026-08-25T05:41:14.285Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74660",
      "date": "2026-09-17",
      "epss": "0.00126",
      "percentile": "0.02595"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74660\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:39.743\",\"lastModified\":\"2026-08-25T06:18:46.943\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: ebt_nflog: pin the NFLOG backend\\n\\nnf_log_unregister() runs after the per-net teardown so its final RCU\\ngrace period also drains readers that obtained the logger from a per-net\\nbinding.  However, ebt_nflog passes an explicit ULOG log type to\\nnf_log_packet() without holding a reference on the selected logger module,\\nunlike the xt_NFLOG and nft_log frontends.\\n\\nAn ebtables nflog rule can therefore remain callable while nfnetlink_log\\nis unloaded.  The resulting interleaving is:\\n\\n  CPU 0                               CPU 1\\n  nfnetlink_log_fini()\\n    unregister_pernet_subsys()\\n      kfree(nfnl_log_pernet(net))\\n                                      ebt_nflog_tg()\\n                                        nf_log_packet()\\n                                          nfulnl_log_packet()\\n                                            instance_lookup_get_rcu()\\n\\nThe global ULOG logger is still registered at this point, so CPU 1\\ndereferences the per-net state after CPU 0 has freed it.  KASAN reported:\\n\\n  BUG: KASAN: slab-use-after-free in instance_lookup_get_rcu\\n  Read of size 8 at addr ff110001052e6210 by task poc/92\\n  Call Trace:\\n   instance_lookup_get_rcu+0x1ce/0x1f0 [nfnetlink_log]\\n   nfulnl_log_packet+0x248/0x2fb0 [nfnetlink_log]\\n   nf_log_packet+0x204/0x300\\n   ebt_nflog_tg+0x351/0x550\\n   ebt_do_table+0xedf/0x22b0\\n  Allocated by task 90:\\n   __kmalloc_noprof+0x186/0x470\\n   ops_init+0x6d/0x420\\n   register_pernet_operations+0x2f6/0x670\\n   register_pernet_subsys+0x23/0x40\\n  Freed by task 93:\\n   kfree+0x131/0x3c0\\n   ops_undo_list+0x3e3/0x700\\n   unregister_pernet_operations+0x232/0x490\\n   unregister_pernet_subsys+0x1c/0x30\\n   nfnetlink_log_fini+0x34/0x450 [nfnetlink_log]\\n\\nAcquire the ULOG logger module reference when an ebt_nflog rule is\\nvalidated and release it when the rule is destroyed.  Request the NFLOG\\nbackend for legacy callers when needed, matching xt_NFLOG.  This prevents\\nmodule teardown until all ebt_nflog rules have stopped using the logger.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/bridge/netfilter/ebt_nflog.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"3bcce49d617c593c7606083bfdb464a1761fa68d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"394d7939c6b2b9e6bea0844c89efb5913168d898\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"2cac4294f184c9bc19ff82552c62b80498694c39\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"9d8a94b48b393885e7f876c8ef68ed4da5012078\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"6809379a860b9fccbb5435bf08343f6d081ac68d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"e2ab7e878bdbe80104c879c31fd2d82a476703b8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c83fa19603bdaeef17b815713dbbe3230c8a34ee\",\"lessThan\":\"30825970339c107bacaf7f61af90fcdb1f597ca1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/bridge/netfilter/ebt_nflog.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2cac4294f184c9bc19ff82552c62b80498694c39\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/30825970339c107bacaf7f61af90fcdb1f597ca1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/394d7939c6b2b9e6bea0844c89efb5913168d898\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/3bcce49d617c593c7606083bfdb464a1761fa68d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47a119ec8a7e2d5c8c4e86fb1a56c4e696e500fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6809379a860b9fccbb5435bf08343f6d081ac68d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d8a94b48b393885e7f876c8ef68ed4da5012078\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e2ab7e878bdbe80104c879c31fd2d82a476703b8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:53:30+00:00",
      "cve": "CVE-2026-74660",
      "id": "CVE-2026-74660",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "246",
      "product_status:known_not_affected": "28",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: ebt_nflog: pin the NFLOG backend",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74660.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:17:08Z",
      "cve": "CVE-2026-74660",
      "id": "CVE-2026-74660",
      "initial_release_date": "2026-08-23T00:05:03Z",
      "product_status:known_affected": "351",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74660",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74660.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.