CVE-2026-74746
CriticalCVSS 9.8Summary
In the Linux kernel, the netfilter flowtable module has a vulnerability where the original-direction tuple node is published before the reply node, allowing the garbage collector to observe and free a flow while it is still being installed. This can lead to slab-use-after-free in the flowtable/rhashtable path, detected by KASAN.
Risk Assessment
An attacker could exploit this vulnerability to cause a system crash or potentially escalate privileges, threatening system integrity and availability.
Recommendation
Apply the official Linux kernel patch that fixes the publication order in flowtable immediately, and monitor for KASAN reports.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).