CVE-2026-74748 Overview
CVE-2026-74748 is a race condition vulnerability in the Linux kernel's netfilter ipset subsystem. The flaw resides in the interaction between __ip_set_put_byindex() and ip_set_swap() when handling list:set garbage collection. A stale set pointer can be dereferenced during a swap operation, triggering a BUG_ON(set->ref == 0) assertion and causing a kernel panic. The maintainers resolved the issue by moving both the index resolution and the reference decrement under ip_set_ref_lock.
Critical Impact
Local attackers with the ability to manipulate ipsets can crash the kernel through a time-of-check to time-of-use race, resulting in denial of service on affected systems.
Affected Products
- Linux kernel (upstream) versions containing the vulnerable ip_set_core.c reference handling logic
- Distributions shipping stable kernels prior to the referenced fix commits
- Systems using netfilter ipset with list:set type entries and timeouts
Discovery Timeline
- 2026-08-26 - CVE-2026-74748 published to NVD
- 2026-08-27 - Last updated in NVD database
Technical Details for CVE-2026-74748
Vulnerability Analysis
The vulnerability is a Time-of-Check to Time-of-Use (TOCTOU) race condition in the netfilter ipset reference counting logic. The function __ip_set_put_byindex() resolves an index to a set pointer while holding only the Read-Copy-Update (RCU) read lock. It then acquires ip_set_ref_lock in __ip_set_put() to decrement set->ref.
Between these two operations, ip_set_swap() can execute while holding ip_set_ref_lock. The swap atomically exchanges both the ip_set_list slot pointers and the two sets' reference counters. If the swap interleaves between the pointer resolution and the lock acquisition, the caller decrements a set whose reference has already been transferred to the other index.
Root Cause
The root cause is inconsistent locking around the index-to-pointer resolution and the reference count decrement. The reference count logically belongs to the index slot rather than to the underlying set pointer. When ip_set_swap() moves references between slots atomically under ip_set_ref_lock, any caller resolving the pointer outside that lock observes a stale binding.
The bug manifests through list_set_gc(), which runs from a timer softirq context. Expiring list:set members invoke list_set_del() and then ip_set_put_byindex(). The nfnl mutex does not serialize timer softirqs against IPSET_CMD_SWAP, allowing the race to occur.
Attack Vector
An attacker with CAP_NET_ADMIN capability in the initial user namespace can trigger the race by creating list:set ipsets with timeout-based expiring members and concurrently issuing IPSET_CMD_SWAP commands. When the garbage collection timer fires simultaneously with an in-flight swap, the kernel hits the BUG_ON(set->ref == 0) assertion at net/netfilter/ipset/ip_set_core.c:685, producing an invalid opcode exception and a fatal kernel panic.
The crash trace shows the fault path traversing ip_set_put_byindex, list_set_del, set_cleanup_entries, list_set_gc, and finally the timer softirq entry points. No verified public exploit code is available for this issue.
Detection Methods for CVE-2026-74748
Indicators of Compromise
- Kernel panic messages referencing kernel BUG at net/netfilter/ipset/ip_set_core.c:685
- Oops output containing invalid opcode with RIP pointing at ip_set_put_byindex
- Call traces showing list_set_gc in IRQ context immediately preceding the panic
- Unexpected host reboots correlated with administrative ipset swap operations
Detection Strategies
- Monitor kernel ring buffer (dmesg) and /var/log/kern.log for BUG_ON traps originating in the ipset code path
- Audit netlink traffic for concurrent IPSET_CMD_SWAP operations against sets that contain list:set members with timeouts
- Correlate system crashes with recent netfilter administrative activity through centralized log analysis
Monitoring Recommendations
- Ingest kernel logs into a centralized log platform and alert on stack traces referencing ip_set_core.c or ip_set_list_set.c
- Track process execution of ipset binaries and associated netlink syscalls from non-standard accounts
- Baseline expected ipset administrative activity and flag anomalous swap frequency
How to Mitigate CVE-2026-74748
Immediate Actions Required
- Apply the upstream Linux stable kernel updates that contain the referenced fix commits and reboot affected hosts
- Restrict CAP_NET_ADMIN to trusted administrative accounts and audit sudoers rules that grant ipset execution
- Prioritize patching on multi-tenant hosts, container hosts, and firewalls where local privilege boundaries are exposed
Patch Information
The fix relocates the index resolution and reference decrement under ip_set_ref_lock, matching the locking discipline already used by ip_set_swap(). This ties the refcount to the index rather than to a potentially stale set pointer. The change is distributed across stable branch commits including 0c88868, 20cb13a, 24ffcb1, 97a01de, b0aab9d, b891e7a, c21afc7, and cb20da3.
Workarounds
- Avoid administrative use of ipset swap on sets containing list:set members with active timeout expirations
- Remove or disable timeout-based list:set configurations until the patched kernel is deployed
- Constrain access to netfilter management through role-based sudo policies and mandatory access control profiles
# Verify the running kernel version against your distribution's advisory
uname -r
# List ipsets that use list:set with timeout support (candidates for workaround)
ipset list -t | awk '/Name:|Type:|Header:/'
# Restrict ipset binary execution to root only
chmod 750 /usr/sbin/ipset
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
