-

CVE-2026-74695

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

Incoming skbs passing through netfilter flowtable offload hooks (or XFRM
offload path) might already carry a ref-counted dst_entry assigned during
earlier RX or routing steps.

Calling skb_dst_set_noref() when skb already holds a ref-counted dst
overwrites skb->_skb_refdst, leaking the previous dst_entry reference
count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in
skb_dst_check_unset():

  WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170
  WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234
  WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864

Drop any existing dst_entry reference with skb_dst_drop(skb) before
setting the non-referenced flowtable destination.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerLinux
≫
Produkt Linux
Default Statusunaffected
Version 2a79fd3908acd88e6cb0e620c314d7b1fee56a02
Version < 12afa450a6a6c0cce2c42b7545a9958f62d8a00c
Status affected
Version 2a79fd3908acd88e6cb0e620c314d7b1fee56a02
Version < 538e67e8c7889cf5f93951f5309d1bcb41f86036
Status affected
Version 2a79fd3908acd88e6cb0e620c314d7b1fee56a02
Version < 8aecf0bbcc72605592134c917c222207d8f63ab0
Status affected
Version b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27
Status affected
Version 209dedf806d31095968f54323dbe62525b077b33
Status affected
Version 4.16.15
Version < 4.17
Status affected
Version 4.17.1
Version < 4.18
Status affected
HerstellerLinux
≫
Produkt Linux
Default Statusaffected
Version 4.18
Status affected
Version 0
Version < 4.18
Status unaffected
Version <= 6.18.*
Version 6.18.45
Status unaffected
Version <= 7.1.*
Version 7.1.9
Status unaffected
Version <= *
Version 7.2
Status unaffected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.21% 0.11
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
Es wurden noch keine Informationen zu CWE veröffentlicht.
https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c
https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036
https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0