CVE-2026-74625: Linux Kernel Netfilter Bridge DoS Vulnerability

CVE-2026-74625 Overview

CVE-2026-74625 is a memory leak vulnerability in the Linux kernel's netfilter bridge subsystem. The flaw exists in nf_ct_bridge_pre(), which handles connection tracking for bridged frames. When a bridge nftables ct zone set rule attaches a conntrack template to a socket buffer (skb) before nf_ct_bridge_pre() processes it, the function overwrites skb->_nfct with IP_CT_UNTRACKED on non-IPv4 and non-IPv6 EtherTypes without releasing the existing template reference. This leaks the per-CPU template and any concurrently allocated temporary templates, exhausting kernel slab memory over time.

Critical Impact
Remote attackers can send crafted non-IP frames through a bridge configured with nftables conntrack zone rules to progressively exhaust kernel slab memory, resulting in denial of service.

Affected Products

Linux kernel versions containing the bridge netfilter conntrack zone functionality
Systems configured with bridge nftables ct zone set rules
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-08-22 - CVE-2026-74625 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74625

Vulnerability Analysis

The vulnerability is a kernel memory leak in the netfilter bridge conntrack handling path. Bridge nftables allow rules such as ct zone set to associate a conntrack template with a frame before it reaches the bridge prerouting hook. The template is referenced through skb->_nfct and holds a reference count on the underlying conntrack object.

When nf_ct_bridge_pre() observes a frame whose EtherType is neither IPv4 nor IPv6, the function marks the frame as untracked by writing IP_CT_UNTRACKED directly into skb->_nfct. This overwrite discards the pointer to the previously attached template without dropping its reference. The template becomes unreachable while its refcount remains elevated, so the kernel never frees it.

Repeated processing of non-IP frames on such a bridge steadily consumes slab memory. Both the per-CPU template and temporary templates allocated for concurrent flows accumulate until slab allocation fails, degrading or halting the host.

Root Cause

The root cause is missing conntrack state cleanup on the non-IP code path in nf_ct_bridge_pre(). The function must reset the existing conntrack state (releasing the template reference) before marking the frame untracked. The upstream fix calls the conntrack reset helper prior to assigning IP_CT_UNTRACKED, ensuring the template reference is properly dropped.

Attack Vector

An attacker on a network segment reachable through a Linux bridge configured with nftables ct zone set rules can transmit non-IPv4, non-IPv6 EtherType frames. Each processed frame triggers a template leak. Sustained traffic produces cumulative slab exhaustion. The attack requires no authentication and no user interaction. It affects availability only.

No public proof-of-concept exploit or CISA KEV listing is associated with CVE-2026-74625. The current EPSS probability is 0.501%. Details on the corrective patch are available in the Kernel GIT Commit 7cff440 and related backports.

Detection Methods for CVE-2026-74625

Indicators of Compromise

Progressive increase in nf_conntrack and related slab caches visible in /proc/slabinfo without a corresponding rise in tracked connections.
Kernel SLUB or SLAB allocation failures and OOM events on bridge hosts running nftables conntrack zone rules.
Unusually high volumes of non-IPv4, non-IPv6 EtherType frames traversing bridges configured with ct zone set rules.

Detection Strategies

Monitor slab consumption trends for nf_conntrack objects on kernel versions predating the fix commits listed in the NVD references.
Correlate bridge interface counters for non-IP EtherTypes with kernel memory pressure metrics.
Audit nftables rulesets for ct zone set statements attached to bridge families and inventory kernel versions on those hosts.

Monitoring Recommendations

Alert on sustained growth of MemSlab and SReclaimable values reported in /proc/meminfo on affected bridge nodes.
Ingest kernel logs into a centralized SIEM and alert on SLUB allocation warnings, OOM killer invocations, and netfilter subsystem messages.
Track kernel package versions across the fleet to identify hosts still running vulnerable builds.

How to Mitigate CVE-2026-74625

Immediate Actions Required

Apply distribution kernel updates that incorporate the upstream fix referenced in the NVD entry.
Identify bridges using nftables ct zone set rules and prioritize patching those hosts first.
Restrict Layer 2 access on affected bridges to trusted endpoints until the patch is deployed.

Patch Information

The fix resets the skb conntrack state before marking the frame untracked, releasing the template reference on the non-IP path. Corrective commits are published in the stable tree: Kernel GIT Commit 46d559f, Kernel GIT Commit 6ea8840, Kernel GIT Commit 7cff440, Kernel GIT Commit bd7b164, Kernel GIT Commit c58d34f, Kernel GIT Commit d45cc80, Kernel GIT Commit daa6e07, and Kernel GIT Commit fc90df3.

Workarounds

Remove or refactor bridge nftables rules that use ct zone set until the kernel is patched, eliminating the template attachment step that triggers the leak.
Filter non-IPv4 and non-IPv6 EtherTypes at ingress on affected bridges using ebtables or Layer 2 access control lists.
Schedule proactive reboots or conntrack subsystem module reloads on long-running bridge hosts to reclaim leaked slab memory as an interim measure.

bash

# Configuration example: audit bridge nftables rulesets for vulnerable ct zone set usage
nft list ruleset | grep -E 'bridge|ct zone set'

# Inspect conntrack slab consumption trends
grep nf_conntrack /proc/slabinfo

# Confirm running kernel version against fixed stable commits
uname -r