CVE-2026-74695 (GCVE-0-2026-74695)
Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-10-16 19:16
VLAI
EPSS
VEX
Title
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Summary
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
offload path) might already carry a ref-counted dst_entry assigned during
earlier RX or routing steps.
Calling skb_dst_set_noref() when skb already holds a ref-counted dst
overwrites skb->_skb_refdst, leaking the previous dst_entry reference
count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
skb_dst_check_unset():
WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170
WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234
WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
Drop any existing dst_entry reference with skb_dst_drop(skb) before
setting the non-referenced flowtable destination.
Severity
7.5 (High)
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 19:14 UTC
Assigner
References
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
2a79fd3908acd88e6cb0e620c314d7b1fee56a02 , < 12afa450a6a6c0cce2c42b7545a9958f62d8a00c
(git)
Affected: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 , < 538e67e8c7889cf5f93951f5309d1bcb41f86036 (git) Affected: 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 , < 8aecf0bbcc72605592134c917c222207d8f63ab0 (git) Affected: b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27 (git) Affected: 209dedf806d31095968f54323dbe62525b077b33 (git) Affected: 4.16.15 , < 4.17 (semver) Affected: 4.17.1 , < 4.18 (semver) |
guessed | |
| Linux | Linux |
Affected:
4.18
Unaffected: 0 , < 4.18 (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74695",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:42.839344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:16:09.664Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "12afa450a6a6c0cce2c42b7545a9958f62d8a00c",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "538e67e8c7889cf5f93951f5309d1bcb41f86036",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "8aecf0bbcc72605592134c917c222207d8f63ab0",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"status": "affected",
"version": "b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27",
"versionType": "git"
},
{
"status": "affected",
"version": "209dedf806d31095968f54323dbe62525b077b33",
"versionType": "git"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.15",
"versionType": "semver"
},
{
"lessThan": "4.18",
"status": "affected",
"version": "4.17.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb-\u003e_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:38.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
},
{
"url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
},
{
"url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
}
],
"title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74695",
"datePublished": "2026-08-22T15:32:57.756Z",
"dateReserved": "2026-08-15T05:44:03.926Z",
"dateUpdated": "2026-10-16T19:16:09.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-74695",
"date": "2026-10-16",
"epss": "0.00426",
"percentile": "0.35414"
},
"microsoft_vex": {
"current_release_date": "2026-09-24T02:39:47.000Z",
"cve": "CVE-2026-74695",
"id": "msrc_CVE-2026-74695",
"initial_release_date": "2026-08-24T01:03:29.000Z",
"product_status:known_affected": "3",
"source": "Microsoft CSAF VEX",
"status": "final",
"title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
"url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74695.json",
"version": "5"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "12afa450a6a6c0cce2c42b7545a9958f62d8a00c",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "538e67e8c7889cf5f93951f5309d1bcb41f86036",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "8aecf0bbcc72605592134c917c222207d8f63ab0",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"status": "affected",
"version": "b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27",
"versionType": "git"
},
{
"status": "affected",
"version": "209dedf806d31095968f54323dbe62525b077b33",
"versionType": "git"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.15",
"versionType": "semver"
},
{
"lessThan": "4.18",
"status": "affected",
"version": "4.17.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnetfilter: nf_flow_table: descartar el dst de skb existente antes de skb_dst_set_noref()\n\nLos skbs entrantes que pasan por los hooks de descarga de la tabla de flujos de netfilter (o la ruta de descarga de XFRM) podr\u00edan ya llevar un dst_entry con contador de referencias asignado durante pasos anteriores de RX o enrutamiento.\n\nLlamar a skb_dst_set_noref() cuando el skb ya contiene un dst con contador de referencias sobrescribe skb -\u003e _skb_refdst, filtrando el contador de referencias del dst_entry anterior y disparando una aserci\u00f3n DEBUG_NET_WARN_ON_ONCE en skb_dst_check_unset():\n\n ADVERTENCIA: en skb_dst_check_unset include/linux/skbuff.h:1170\n ADVERTENCIA: en skb_dst_set_noref include/linux/skbuff.h:1234\n ADVERTENCIA: en nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDescartar cualquier referencia de dst_entry existente con skb_dst_drop(skb) antes de establecer el destino de la tabla de flujos sin referencias."
}
],
"id": "CVE-2026-74695",
"lastModified": "2026-10-16T20:17:52.320",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-74695",
"options": [
{
"exploitation": "none"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:42.839344Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-08-22T16:16:44.050",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Received"
}
},
"redhat_vex": {
"aggregate_severity": "Moderate",
"current_release_date": "2026-08-25T08:54:28+00:00",
"cve": "CVE-2026-74695",
"id": "CVE-2026-74695",
"initial_release_date": "2026-08-22T00:00:00+00:00",
"product_status:known_affected": "232",
"product_status:known_not_affected": "42",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74695.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-74695",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T19:14:42.839344Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T19:14:43.386Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "12afa450a6a6c0cce2c42b7545a9958f62d8a00c",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "538e67e8c7889cf5f93951f5309d1bcb41f86036",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"lessThan": "8aecf0bbcc72605592134c917c222207d8f63ab0",
"status": "affected",
"version": "2a79fd3908acd88e6cb0e620c314d7b1fee56a02",
"versionType": "git"
},
{
"status": "affected",
"version": "b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27",
"versionType": "git"
},
{
"status": "affected",
"version": "209dedf806d31095968f54323dbe62525b077b33",
"versionType": "git"
},
{
"lessThan": "4.17",
"status": "affected",
"version": "4.16.15",
"versionType": "semver"
},
{
"lessThan": "4.18",
"status": "affected",
"version": "4.17.1",
"versionType": "semver"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/netfilter/nf_flow_table_ip.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "4.18"
},
{
"lessThan": "4.18",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.45",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.1.*",
"status": "unaffected",
"version": "7.1.9",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.45",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1.9",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.2",
"versionStartIncluding": "4.18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.16.15",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "4.17.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()\n\nIncoming skbs passing through netfilter flowtable offload hooks (or XFRM\noffload path) might already carry a ref-counted dst_entry assigned during\nearlier RX or routing steps.\n\nCalling skb_dst_set_noref() when skb already holds a ref-counted dst\noverwrites skb-\u003e_skb_refdst, leaking the previous dst_entry reference\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in\nskb_dst_check_unset():\n\n WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170\n WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234\n WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864\n\nDrop any existing dst_entry reference with skb_dst_drop(skb) before\nsetting the non-referenced flowtable destination."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:N - The bug fires in nf_flow_offload_ip_hook on NF_NETDEV_INGRESS when remotely sourced IPv4/IPv6 packets matching an offloaded flow are received on nftables flowtable-bound interfaces, not via netlink configuration APIs.\nAC:L - Once a flowtable ingress hook and offloaded TCP/UDP flow exist, an attacker can reliably send matching traffic that reaches FLOW_OFFLOAD_XMIT_NEIGH or the XFRM offload path with a ref-counted skb dst; syzbot reproduced this without uncontrollable races.\nPR:N - Exploitation requires only sending network traffic through an already deployed nftables flow-offload path on an ingress device; no local account, authentication, or CAP_NET_ADMIN on the victim is needed to trigger the leak.\nUI:N - No victim interaction is required beyond normal network delivery; packets are processed automatically in softirq on the netdev ingress netfilter hook without opening files or mounting filesystems.\nS:U - Impact is confined to kernel refcount imbalance and availability degradation on the affected host; this is standard in-kernel compromise territory, not a VM escape, IOMMU bypass, or other cross-authority scope change.\nC:N - The flaw leaks a dst_entry reference by overwriting skb-\u003e_skb_refdst without releasing the prior dst; it does not expose kernel memory or provide an arbitrary read primitive.\nI:N - No unauthorized data modification occurs; the skb is forwarded using the intended flowtable destination while the previous dst reference is orphaned, not corrupted into a controllable write primitive.\nA:H - Each matching packet leaks a dst_entry refcount on the flowtable fast path, enabling sustained unauthenticated remote memory exhaustion on high-volume routers; CONFIG_DEBUG_NET builds also emit WARN_ON_ONCE during the overwrite."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-25T05:41:38.836Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c"
},
{
"url": "https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036"
},
{
"url": "https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0"
}
],
"title": "netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-74695",
"datePublished": "2026-08-22T15:32:57.756Z",
"dateReserved": "2026-08-15T05:44:03.926Z",
"dateUpdated": "2026-10-16T19:16:09.664Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.