{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_timeout.h",
            "net/netfilter/nf_conntrack_core.c",
            "net/netfilter/nf_conntrack_timeout.c",
            "net/netfilter/nfnetlink_cttimeout.c",
            "net/netfilter/nft_ct.c",
            "net/netfilter/xt_CT.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9aeb0dcfeb460d33d61d434148b51103ab1d2013",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            },
            {
              "lessThan": "7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549",
              "status": "affected",
              "version": "50978462300f74dc48aea4a38471cb69bdf741a5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_conntrack_timeout.h",
            "net/netfilter/nf_conntrack_core.c",
            "net/netfilter/nf_conntrack_timeout.c",
            "net/netfilter/nfnetlink_cttimeout.c",
            "net/netfilter/nft_ct.c",
            "net/netfilter/xt_CT.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.4"
            },
            {
              "lessThan": "3.4",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.4",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: cttimeout: detach dataplane timeout policy and repurpose refcount\n\nAdd a refcount for struct nf_ct_timeout which is used by ct extension to\nset the custom ct timeout policy, this tells us that the ct timeout is\nbeing used by a conntrack entry. When the last conntrack entry drops the\nrefcount on the ct timeout, the ct timeout is released.\n\nRemove the refcount for control plane which controls if the ruleset\nrefers to the timeout policy. After this update, it is possible to\nremove the ct timeout policy from nfnetlink_cttimeout immediately.\nThis is for simplicity not to handle two refcounts on a single object.\n\nRemove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just\nhold a reference to the nf_ct_timeout object until packet is reinjected,\nsince this is part of the ct extension, this will be released by the\ntime the conntrack is freed.\n\nnf_ct_untimeout() is still called to clean up in a best effort basis:\nthe ct timeout on existing entries gets removed when the ct timeout goes\naway, but as long as the iptables ruleset still refers to the ct timeout\nthrough a template, new conntracks may keep attaching it and extend its\nlifetime until the rule is removed.\n\nnf_ct_untimeout() is not called anymore from module removal path, this\nis unlikely to find timeouts give module refcount is bumped, and the new\nrefcount already tracks the ct timeout policy use so it is released when\nunused."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires netlink control-plane operations (nfnetlink_cttimeout delete, nftables timeout object destroy, or iptables CT template removal) gated by CAP_NET_ADMIN; the UAF is exercised in local conntrack packet handling, not by unauthenticated remote packets alone.\nAC:L - An attacker with namespace admin can create timeout policies, drive concurrent conntrack traffic on multiple CPUs, and delete or replace the policy while packets still read it via RCU in nf_conntrack_tcp_packet; they control both teardown and dataplane readers.\nPR:L - All trigger paths require CAP_NET_ADMIN for nfnetlink/nftables/iptables configuration; netlink_net_capable() checks capability against the socket network namespace user_ns, so unprivileged local users can obtain it via user and network namespaces on common kernels.\nUI:N - No victim interaction is required; the attacker configures timeout policies, generates matching traffic, and tears down the policy while conntrack handlers still reference it, fully driving the race themselves.\nS:U - Impact is kernel heap corruption within the netfilter/conntrack subsystem of the same kernel security authority; it does not cross VM, hypervisor, or IOMMU isolation boundaries.\nC:H - This is a slab use-after-free of nf_ct_timeout objects still dereferenced through RCU in nf_ct_timeout_lookup() during TCP/UDP/SCTP conntrack handlers; freed objects can be reallocated to obtain arbitrary kernel memory read primitives.\nI:H - UAF of heap-allocated timeout policy data enables heap spraying and object replacement to corrupt adjacent structures or control flow, supporting arbitrary kernel write and local privilege escalation.\nA:H - Concurrent readers of freed timeout policy memory in nf_conntrack_tcp_packet and related handlers can trigger KASAN slab-use-after-free faults and kernel oops or panic, as demonstrated in the closely related nft_ct timeout destroy report."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:11.668Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9aeb0dcfeb460d33d61d434148b51103ab1d2013"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d6a9cdb8d3a51d9cfe546a09a518ab3d2671549"
        }
      ],
      "title": "netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74347",
    "datePublished": "2026-08-15T05:58:35.287Z",
    "dateReserved": "2026-08-15T05:44:03.886Z",
    "dateUpdated": "2026-08-17T05:46:11.668Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}