CVE-2026-74695: Linux Kernel Privilege Escalation Flaw

CVE-2026-74695 Overview

CVE-2026-74695 is a Linux kernel vulnerability in the netfilter flowtable offload code path. Incoming socket buffers (skbs) traversing netfilter flowtable offload hooks or the XFRM offload path may already hold a reference-counted dst_entry assigned during earlier receive or routing steps. Calling skb_dst_set_noref() on such an skb overwrites skb->_skb_refdst, leaking the previous dst_entry reference and triggering a DEBUG_NET_WARN_ON_ONCE assertion. The fix drops any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.

Critical Impact
A remote, unauthenticated attacker can send network traffic that triggers reference leaks and warning conditions in the kernel networking stack, leading to resource exhaustion and denial of service.

Affected Products

Linux kernel versions containing the netfilter flowtable offload code path prior to the fix
Systems using nf_flow_offload_ip_hook in net/netfilter/nf_flow_table_ip.c
Kernels utilizing the XFRM offload path with flowtable acceleration enabled

Discovery Timeline

2026-08-22 - CVE-2026-74695 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74695

Vulnerability Analysis

The vulnerability resides in the netfilter flowtable offload code, specifically in nf_flow_offload_ip_hook located in net/netfilter/nf_flow_table_ip.c. When packets arrive and pass through the flowtable offload hooks, the kernel invokes skb_dst_set_noref() to attach a non-reference-counted destination entry to the skb. If the skb already carries a reference-counted dst_entry from a prior RX or routing step, this call overwrites skb->_skb_refdst directly. The previous reference is never released, producing a dst_entry reference count leak.

The kernel's debug facility surfaces this condition through DEBUG_NET_WARN_ON_ONCE assertions in skb_dst_check_unset() at include/linux/skbuff.h:1170 and skb_dst_set_noref() at include/linux/skbuff.h:1234. Sustained triggering exhausts routing cache resources and destabilizes the networking stack.

Root Cause

The root cause is a missing precondition check before invoking skb_dst_set_noref(). The netfilter flowtable offload path assumed incoming skbs had no attached dst_entry, but skbs traversing the XFRM offload path or earlier routing stages can arrive with a reference-counted destination already set. Overwriting _skb_refdst without first dropping the existing reference causes a memory reference leak classified as a resource management defect.

Attack Vector

An unauthenticated remote attacker can send crafted network traffic designed to traverse the netfilter flowtable offload hook path on a target Linux system. Each qualifying packet leaks a dst_entry reference. Repeated triggering degrades kernel memory availability and network subsystem health, producing a denial-of-service condition. The vulnerability requires no user interaction and no privileges.

The vulnerability is fixed by inserting skb_dst_drop(skb) before skb_dst_set_noref() in the flowtable offload path. See the upstream commits 12afa45, 538e67e, and 8aecf0b for the corrective patches.

Detection Methods for CVE-2026-74695

Indicators of Compromise

Kernel log warnings referencing skb_dst_check_unset at include/linux/skbuff.h:1170
Kernel log warnings referencing skb_dst_set_noref at include/linux/skbuff.h:1234
Warnings from nf_flow_offload_ip_hook+0xf6c/0x2b60 in net/netfilter/nf_flow_table_ip.c:864
Progressive growth in kernel slab allocations tied to dst_entry objects without corresponding frees

Detection Strategies

Parse dmesg and journalctl -k output for the specific WARNING signatures listed above
Monitor /proc/slabinfo for abnormal growth in destination cache entries on hosts using netfilter flowtables
Correlate networking subsystem warnings with sustained inbound traffic on interfaces enrolled in flowtable offload

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on the flowtable warning strings
Track kernel memory pressure metrics on gateways, routers, and firewalls running affected kernels
Baseline expected flowtable hook throughput and alert on unusual packet rates that could indicate exploitation attempts

How to Mitigate CVE-2026-74695

Immediate Actions Required

Update to a Linux kernel release that includes the upstream patches referenced by commits 12afa45, 538e67e, and 8aecf0b
Prioritize patching on hosts using netfilter flowtable offload or XFRM offload, such as gateways, routers, and firewalls
Restart affected systems after patch application to ensure the corrected kernel image is active

Patch Information

The fix adds skb_dst_drop(skb) before skb_dst_set_noref() in the netfilter flowtable offload hook, ensuring any pre-existing dst_entry reference is released prior to assigning the non-referenced destination. Apply distribution-provided kernel updates that incorporate the upstream stable commits, or rebuild kernels from source with the referenced patches applied.

Workarounds

Disable netfilter flowtable offload on affected systems until a patched kernel is installed by removing flowtable rules from nftables configurations
Avoid combining XFRM offload with flowtable offload on the same interface where feasible
Restrict inbound network exposure of affected hosts to trusted networks while patching is scheduled

bash

# Configuration example: remove flowtable acceleration in nftables until patched
sudo nft list ruleset
sudo nft delete flowtable inet filter f
sudo systemctl restart nftables