CVE-2026-74625 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: release template ct on non-IP path
A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.
Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/23/2026
The vulnerability identified in the Linux kernel involves a critical resource management flaw within the netfilter bridge subsystem, specifically affecting how connection tracking templates are handled for non-Internet Protocol traffic. This issue arises when an nftables rule configured to set a conntrack zone on bridged packets attaches a connection tracking template to a socket buffer before it reaches the nf_ct_bridge_pre function. The core technical flaw lies in the handling of EtherTypes that do not correspond to IPv4 or IPv6 protocols. In these scenarios, the kernel logic proceeds to mark the frame as untracked by overwriting the skb->_nfct field with IP_CT_UNTRACKED. However, this operation is performed without first releasing the reference count for the previously attached connection tracking template. This oversight results in a memory leak because the per-cpu template and any temporary templates allocated for concurrent use become unreachable within the kernel's memory management subsystem.
From an operational perspective, this vulnerability leads to progressive resource exhaustion on the affected host system. As network traffic containing non-IP EtherTypes flows through the bridged interface, each packet triggers a new allocation of connection tracking resources that are never properly freed due to the missing release call. Over time, these unreleased slab allocations accumulate, consuming available kernel memory. If left unmitigated, this continuous leakage can eventually deplete the system's slab cache, leading to severe performance degradation or complete host instability as the operating system runs out of critical memory resources required for other operations. This represents a denial-of-service condition driven by resource exhaustion rather than direct exploitation of logic flaws in data processing.
The technical classification of this vulnerability aligns with CWE-401, which describes missing release of memory after effective lifetime, and specifically relates to improper reference counting mechanisms that fail to decrement object counts when references are discarded or overwritten. In the context of the MITRE ATT&CK framework, this behavior can be associated with T1529 System Shutdown or Reboot if the resource exhaustion leads to a crash, although it is primarily categorized under Resource Hijacking techniques where an attacker could potentially trigger high volumes of non-IP traffic to exhaust system resources. The root cause is a failure in state management within the network packet processing pipeline, where the transition from tracked to untracked status bypasses necessary cleanup procedures for auxiliary data structures like connection tracking templates.
To mitigate this vulnerability, it is essential to apply the kernel patch that corrects the reference counting logic in the nf_ct_bridge_pre function. The fix involves resetting the socket buffer's connection track state before marking the frame as untracked, ensuring that any existing template references are properly dropped and their memory returned to the slab allocator for reuse. System administrators should ensure that all Linux kernels running bridge-based networking with nftables conntrack rules are updated to versions containing this specific patch. Additionally, monitoring kernel slab usage metrics can help detect early signs of such leaks in environments where non-IP bridged traffic is prevalent, allowing for proactive intervention before resource exhaustion impacts system stability.