CVE-2026-74746
Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
How to fix
- Linux Linux0a00254585827f1695aa2700114af622ea754cfa, be345dcbddb4643a54252b954af974b16eda8f91, 211ee5d998d92a7d548811939c65942d06c146e4, d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2, 972fdf7c4f5c282a239c88fea614b056c33dc025, d9d3050a70efe217e73a0751e55fdae6a7092620, d16b71231e65cb05daea2b45701fcf09cef041e7, 2014ac62df9d45bb9a004a043e85df7be09ed780 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < 0a00254585827f1695aa2700114af622ea754cfa, ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < be345dcbddb4643a54252b954af974b16eda8f91, ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < 211ee5d998d92a7d548811939c65942d06c146e4, ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2, ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < 972fdf7c4f5c282a239c88fea614b056c33dc025, ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < d9d3050a70efe217e73a0751e55fdae6a7092620, ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < d16b71231e65cb05daea2b45701fcf09cef041e7, ac2a66665e231847cab11b8c8e844ce43207dd2e ≤ v < 2014ac62df9d45bb9a004a043e85df7be09ed780, 4.16 | 0a00254585827f1695aa2700114af622ea754cfa, be345dcbddb4643a54252b954af974b16eda8f91, 211ee5d998d92a7d548811939c65942d06c146e4, d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2, 972fdf7c4f5c282a239c88fea614b056c33dc025, d9d3050a70efe217e73a0751e55fdae6a7092620, d16b71231e65cb05daea2b45701fcf09cef041e7, 2014ac62df9d45bb9a004a043e85df7be09ed780 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.