GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74347 (GCVE-0-2026-74347)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount Add a refcount for struct nf_ct_timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used by a conntrack entry. When the last conntrack entry drops the refcount on the ct timeout, the ct timeout is released. Remove the refcount for control plane which controls if the ruleset refers to the timeout policy. After this update, it is possible to remove the ct timeout policy from nfnetlink_cttimeout immediately. This is for simplicity not to handle two refcounts on a single object. Remove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just hold a reference to the nf_ct_timeout object until packet is reinjected, since this is part of the ct extension, this will be released by the time the conntrack is freed. nf_ct_untimeout() is still called to clean up in a best effort basis: the ct timeout on existing entries gets removed when the ct timeout goes away, but as long as the iptables ruleset still refers to the ct timeout through a template, new conntracks may keep attaching it and extend its lifetime until the rule is removed. nf_ct_untimeout() is not called anymore from module removal path, this is unlikely to find timeouts give module refcount is bumped, and the new refcount already tracks the ct timeout policy use so it is released when unused.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 50978462300f74dc48aea4a38471cb69bdf741a5 , < 9aeb0dcfeb460d33d61d434148b51103ab1d2013 (git)
Affected: 50978462300f74dc48aea4a38471cb69bdf741a5 , < 7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.4
Unaffected: 0 , < 3.4 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_timeout.h",
            "net/netfilter/nf_conntrack_core.c",
            "net/netfilter/nf_conntrack_timeout.c",
            "net/netfilter/nfnetlink_cttimeout.c",
            "net/netfilter/nft_ct.c",
            "net/netfilter/xt_CT.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9aeb0dcfeb460d33d61d434148b51103ab1d2013",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            },
            {
              "lessThan": "7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_timeout.h",
            "net/netfilter/nf_conntrack_core.c",
            "net/netfilter/nf_conntrack_timeout.c",
            "net/netfilter/nfnetlink_cttimeout.c",
            "net/netfilter/nft_ct.c",
            "net/netfilter/xt_CT.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: detach dataplane timeout policy and repurpose refcount\n\nAdd a refcount for struct nf_ct_timeout which is used by ct extension to\nset the custom ct timeout policy, this tells us that the ct timeout is\nbeing used by a conntrack entry. When the last conntrack entry drops the\nrefcount on the ct timeout, the ct timeout is released.\n\nRemove the refcount for control plane which controls if the ruleset\nrefers to the timeout policy. After this update, it is possible to\nremove the ct timeout policy from nfnetlink_cttimeout immediately.\nThis is for simplicity not to handle two refcounts on a single object.\n\nRemove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just\nhold a reference to the nf_ct_timeout object until packet is reinjected,\nsince this is part of the ct extension, this will be released by the\ntime the conntrack is freed.\n\nnf_ct_untimeout() is still called to clean up in a best effort basis:\nthe ct timeout on existing entries gets removed when the ct timeout goes\naway, but as long as the iptables ruleset still refers to the ct timeout\nthrough a template, new conntracks may keep attaching it and extend its\nlifetime until the rule is removed.\n\nnf_ct_untimeout() is not called anymore from module removal path, this\nis unlikely to find timeouts give module refcount is bumped, and the new\nrefcount already tracks the ct timeout policy use so it is released when\nunused."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires netlink control-plane operations (nfnetlink_cttimeout delete, nftables timeout object destroy, or iptables CT template removal) gated by CAP_NET_ADMIN; the UAF is exercised in local conntrack packet handling, not by unauthenticated remote packets alone.\nAC:L - An attacker with namespace admin can create timeout policies, drive concurrent conntrack traffic on multiple CPUs, and delete or replace the policy while packets still read it via RCU in nf_conntrack_tcp_packet; they control both teardown and dataplane readers.\nPR:L - All trigger paths require CAP_NET_ADMIN for nfnetlink/nftables/iptables configuration; netlink_net_capable() checks capability against the socket network namespace user_ns, so unprivileged local users can obtain it via user and network namespaces on common kernels.\nUI:N - No victim interaction is required; the attacker configures timeout policies, generates matching traffic, and tears down the policy while conntrack handlers still reference it, fully driving the race themselves.\nS:U - Impact is kernel heap corruption within the netfilter/conntrack subsystem of the same kernel security authority; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - This is a slab use-after-free of nf_ct_timeout objects still dereferenced through RCU in nf_ct_timeout_lookup() during TCP/UDP/SCTP conntrack handlers; freed objects can be reallocated to obtain arbitrary kernel memory read primitives.\nI:H - UAF of heap-allocated timeout policy data enables heap spraying and object replacement to corrupt adjacent structures or control flow, supporting arbitrary kernel write and local privilege escalation.\nA:H - Concurrent readers of freed timeout policy memory in nf_conntrack_tcp_packet and related handlers can trigger KASAN slab-use-after-free faults and kernel oops or panic, as demonstrated in the closely related nft_ct timeout destroy report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:11.668Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9aeb0dcfeb460d33d61d434148b51103ab1d2013"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549"
        }
      ],
      "title": "netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74347",
    "datePublished": "2026-08-15T05:58:35.287Z",
    "dateReserved": "2026-08-15T05:44:03.886Z",
    "dateUpdated": "2026-08-17T05:46:11.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74347",
      "date": "2026-09-05",
      "epss": "0.0012",
      "percentile": "0.02077"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:42:47.000Z",
      "cve": "CVE-2026-74347",
      "id": "msrc_CVE-2026-74347",
      "initial_release_date": "2026-08-23T14:42:47.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74347.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74347\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:35.860\",\"lastModified\":\"2026-08-17T06:19:29.283\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: cttimeout: detach dataplane timeout policy and repurpose refcount\\n\\nAdd a refcount for struct nf_ct_timeout which is used by ct extension to\\nset the custom ct timeout policy, this tells us that the ct timeout is\\nbeing used by a conntrack entry. When the last conntrack entry drops the\\nrefcount on the ct timeout, the ct timeout is released.\\n\\nRemove the refcount for control plane which controls if the ruleset\\nrefers to the timeout policy. After this update, it is possible to\\nremove the ct timeout policy from nfnetlink_cttimeout immediately.\\nThis is for simplicity not to handle two refcounts on a single object.\\n\\nRemove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just\\nhold a reference to the nf_ct_timeout object until packet is reinjected,\\nsince this is part of the ct extension, this will be released by the\\ntime the conntrack is freed.\\n\\nnf_ct_untimeout() is still called to clean up in a best effort basis:\\nthe ct timeout on existing entries gets removed when the ct timeout goes\\naway, but as long as the iptables ruleset still refers to the ct timeout\\nthrough a template, new conntracks may keep attaching it and extend its\\nlifetime until the rule is removed.\\n\\nnf_ct_untimeout() is not called anymore from module removal path, this\\nis unlikely to find timeouts give module refcount is bumped, and the new\\nrefcount already tracks the ct timeout policy use so it is released when\\nunused.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/netfilter/nf_conntrack_timeout.h\",\"net/netfilter/nf_conntrack_core.c\",\"net/netfilter/nf_conntrack_timeout.c\",\"net/netfilter/nfnetlink_cttimeout.c\",\"net/netfilter/nft_ct.c\",\"net/netfilter/xt_CT.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"50978462300f74dc48aea4a38471cb69bdf741a5\",\"lessThan\":\"9aeb0dcfeb460d33d61d434148b51103ab1d2013\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"50978462300f74dc48aea4a38471cb69bdf741a5\",\"lessThan\":\"7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/netfilter/nf_conntrack_timeout.h\",\"net/netfilter/nf_conntrack_core.c\",\"net/netfilter/nf_conntrack_timeout.c\",\"net/netfilter/nfnetlink_cttimeout.c\",\"net/netfilter/nft_ct.c\",\"net/netfilter/xt_CT.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.4\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.4\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9aeb0dcfeb460d33d61d434148b51103ab1d2013\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T20:52:58+00:00",
      "cve": "CVE-2026-74347",
      "id": "CVE-2026-74347",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74347.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.