CVE-2026-74746 Overview
CVE-2026-74746 is a use-after-free vulnerability in the Linux kernel's netfilter flowtable subsystem. The flaw exists in flow_offload_add(), which publishes flow tuple nodes in an order that lets garbage collection (GC) observe and free a partially installed flow. The nf_flow_table_iterate() routine treats original-direction tuple nodes as owning entries. When the original node is published before the reply node, GC can free the flow while flow_offload_add() is still inserting the reply node. KASAN reports slab-use-after-free reads and writes across rht_deferred_worker, jhash, flow_offload_del, and flow_offload_lookup.
Critical Impact
A network-reachable attacker can trigger memory corruption in the kernel flowtable path, leading to denial of service or potential code execution in kernel context.
Affected Products
- Linux kernel netfilter flowtable subsystem
- Distributions shipping affected upstream kernel versions with flowtable offload enabled
- Systems using conntrack-based flow offload for packet forwarding
Discovery Timeline
- 2026-08-26 - CVE-2026-74746 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74746
Vulnerability Analysis
The Linux kernel netfilter flowtable accelerates packet forwarding by caching connection state in an rhashtable. Each flow contains two tuple nodes: an original-direction node and a reply-direction node. Both must be present for lookups and iteration to behave correctly.
The bug is an ordering issue in flow_offload_add(). The function inserted the original-direction node into the rhashtable before the reply-direction node. Because nf_flow_table_iterate() uses the original tuple as the owning reference, GC can enumerate the flow, decide it is expired, and free the underlying memory while the caller is still writing the reply node. Concurrent lookup and delete paths then dereference freed memory.
Root Cause
The root cause is a publication-order race between insertion and garbage collection [CWE-416]. Publishing the owning (original) tuple first exposes a window in which GC can reach a flow whose reply node has not yet been linked. The fix reverses insertion order: the reply node is published first and the original node last, so GC never observes a partially installed flow.
Attack Vector
An attacker capable of driving high connection churn through a system that offloads flows to the flowtable can race insertion against GC. The remote network attack surface arises because flow creation is triggered by inbound and forwarded traffic. Successful exploitation produces slab-use-after-free conditions in flow_offload_lookup, flow_offload_del, and the rhashtable worker rht_deferred_worker, which can be leveraged for kernel memory corruption or denial of service.
See the upstream commits referenced under Kernel.org Commit - 0a0025458582 and Kernel.org Commit - d16b71231e65 for the corrected insertion sequence.
Detection Methods for CVE-2026-74746
Indicators of Compromise
- KASAN reports referencing slab-use-after-free in flow_offload_lookup, flow_offload_del, or nf_flow_table_iterate
- Kernel oops or panic traces containing rht_deferred_worker or jhash on systems with flowtable offload enabled
- Unexplained kernel crashes on gateways or routers under high connection-rate workloads
Detection Strategies
- Enable KASAN on test kernels to surface use-after-free reads and writes in the netfilter flowtable path
- Monitor dmesg and centralized log ingestion for BUG: KASAN and general protection fault events tied to netfilter symbols
- Correlate kernel version fingerprints against the fixed commits listed on kernel.org to identify unpatched hosts
Monitoring Recommendations
- Alert on unexpected kernel restarts or watchdog resets on systems using nft flowtable or nf_flow_table_offload
- Track abnormal spikes in short-lived connections against edge and forwarding hosts, which stress the insertion/GC race window
- Ingest kernel telemetry into a centralized data lake to enable retrospective search for the affected stack traces
How to Mitigate CVE-2026-74746
Immediate Actions Required
- Apply the upstream stable kernel updates that reorder tuple publication in flow_offload_add()
- Inventory hosts using nft flowtable or nf_flow_table_offload and prioritize patching gateways, routers, and NAT hosts
- Restrict untrusted network access to affected forwarding hosts until patches are deployed
Patch Information
The fix is available in the Linux stable tree across multiple branches. Reference commits: Kernel.org Commit - 0a0025458582, Kernel.org Commit - 2014ac62df9d, Kernel.org Commit - 211ee5d998d9, Kernel.org Commit - 972fdf7c4f5c, Kernel.org Commit - be345dcbddb4, Kernel.org Commit - d16b71231e65, Kernel.org Commit - d37917e7bebe, and Kernel.org Commit - d9d3050a70ef. Rebuild or install vendor kernel packages that incorporate these commits and reboot.
Workarounds
- Disable flowtable offload by removing nft flowtable rules or unloading nf_flow_table where operationally feasible
- Reduce exposure by rate-limiting inbound connection establishment on affected forwarding hosts
- Where patching is delayed, restrict management and forwarded traffic to trusted networks to shrink the reachable attack surface
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
