CVE-2026-74746 in Linux
Summary
by MITRE • 08/26/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish GC-visible tuple last
nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/26/2026
The vulnerability identified within the Linux kernel's netfilter subsystem involves a race condition in the flow table implementation that leads to use-after-free memory corruption. This issue specifically affects the nf_flow_table_iterate function and its interaction with the garbage collection mechanism responsible for managing flow entries. The core of the problem lies in the order in which tuple nodes are published during the insertion process. Originally, the system treated original-direction tuple nodes as the owners of flow table entries. Consequently, when a new flow was being established, the original direction node was made visible to the garbage collector before the reply direction node was fully integrated into the data structures.
This ordering creates a critical window where the garbage collection mechanism can observe and attempt to free a flow entry while it is only partially installed. Specifically, during the execution of flow_offload_add, which inserts the reply node, the previously published original node may be deemed eligible for deletion by the concurrent garbage collector because it appears incomplete or orphaned from the perspective of the GC logic. When the garbage collector proceeds to free this memory, any subsequent access to that memory region results in a use-after-free condition. This is particularly dangerous as it can lead to arbitrary code execution if an attacker can control the data written into the freed memory space before it is reallocated for another purpose.
The operational impact of this vulnerability manifests through kernel crashes and potential security breaches. The Linux Kernel Address Sanitizer (KASAN) has been observed triggering slab-use-after-free read and write reports in the flowtable and rhashtable paths. These errors occur during operations such as deferred worker processing, hash function calculations, deletion of offloaded flows, and lookup procedures. Such instability can cause denial of service by crashing the kernel or compromising system integrity if the corrupted memory leads to unexpected behavior in network packet processing logic. The vulnerability affects systems relying on hardware flow offloading features provided by netfilter, which are commonly used to accelerate high-throughput networking tasks.
From a technical standards perspective, this flaw aligns with CWE-416, Use After Free, where program execution continues after memory has been freed, leading to undefined behavior. It also relates to CWE-362, Concurrent Execution using Shared Resource with Improper Synchronization, as the race condition arises from improper synchronization between the flow insertion process and the garbage collection routine. In terms of MITRE ATT&CK mapping, this vulnerability could be leveraged for Defense Evasion or Privilege Escalation by exploiting kernel memory corruption to bypass security controls or gain elevated privileges within the operating system environment.
Mitigation strategies primarily involve applying vendor-provided patches that update the Linux kernel version on affected systems. The fix ensures that the reply node is published first and the original node last, thereby preventing the garbage collector from observing a partially installed flow state. Administrators should verify their current kernel versions against known vulnerable ranges provided by distribution security advisories. Additionally, enabling KASAN in development or testing environments can help detect similar race conditions early in the software lifecycle. For production systems, ensuring that netfilter modules are updated to include this synchronization fix is essential to maintain network stack stability and prevent potential exploitation of memory corruption vulnerabilities.