HIGH
netfilter FlowTable Leak
CVE-2026-74695
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
KernelScan AI7.5HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref() Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps. Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset(): WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864 Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.
02KernelScan AI Analysis
Risk summary
A reference-count leak in the netfilter flowtable offload path allows a remote attacker to exhaust kernel memory by sending packets through a device with flowtable offload enabled. Each qualifying packet leaks a dst_entry that can never be freed, and sustained traffic can drive the system to OOM. The flowtable offload feature must be configured by an administrator, but triggering the leak itself requires no privileges beyond network reachability.
Vulnerability analysis
When a network packet carrying a ref-counted destination entry traverses a netfilter flowtable offload hook, the offload code overwrites the packet's destination pointer with a non-referenced destination without first releasing the existing reference. This leaks the previous destination entry's reference count, leaving it permanently pinned in kernel memory. Repeated occurrences accumulate unreachable memory and can eventually cause OOM. The fix adds an explicit drop of any existing destination reference before installing the non-referenced flowtable destination, ensuring the prior entry's reference count is properly decremented. The vulnerable path is reached by any forwarded packet once an administrator has configured flowtable offload; no special privileges are needed to trigger the leak — only the ability to send traffic that traverses the device.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 4.17 | 4.17.1 | 4.18 | 538e67e8c788 |
| 7.1 | — | 7.1.9 | — |
| mainline | — | 7.2 | — |
| 4.16 | 4.16.15 | 4.17 | 12afa450a6a6 |
| 6.18 | — | 6.18.45 | 8aecf0bbcc72 |