CRITICAL Introduced in 4.16
netfilter FlowTable Race
CVE-2026-74746
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
KernelScan AI8.1HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
02KernelScan AI Analysis
Risk summary
A race condition in the netfilter flow table infrastructure allows the garbage collector to free a flow entry while it is still being installed, leading to use-after-free memory corruption. Any network traffic forwarded through a device with flow offloading enabled can trigger the race, requiring no privileges on the target device. The corruption can lead to kernel crashes or potentially arbitrary code execution.
Vulnerability analysis
The netfilter flow table infrastructure installs each forwarded flow in two steps, and the garbage collector that reaps expired flows only recognizes entries once the first step completes. Because the original-direction entry is published before the reply-direction entry, the collector can observe and free a flow that is still being installed, causing use-after-free memory corruption in the flow table and lookup paths. The fix reverses the insertion order so the reply entry is inserted first and the original entry is published last, ensuring the collector never sees a partially installed flow. The vulnerable path is reached when network traffic is forwarded through a device with flow offloading enabled, which requires an administrator to have configured the flow table; no privileges on the target device are needed to trigger the race by sending traffic through it.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| mainline | 4.16 | 7.2 | 2014ac62df9d |
| 5.10 | 4.16 | 5.10.266 | 0a0025458582 |
| 5.15 | 4.16 | 5.15.217 | be345dcbddb4 |
| 6.1 | 4.16 | 6.1.184 | 211ee5d998d9 |
| 6.12 | 4.16 | 6.12.105 | 972fdf7c4f5c |
| 7.1 | 4.16 | 7.1.10 | d16b71231e65 |
| 6.6 | 4.16 | 6.6.153 | d37917e7bebe |
| 6.18 | 4.16 | 6.18.46 | d9d3050a70ef |
| cip/4.19 | 4.16 | 4.19.325-cip136 | 3e9046b5ee58 |
| cip/4.19-rt | 4.16 | 4.19.325-cip136-rt50 | 3e9046b5ee58 |
| cip/5.10 | 4.16 | 5.10.268-cip77 | 0a0025458582 |
| cip/5.10-rt | 4.16 | 5.10.268-cip77-rt34 | 0a0025458582 |
| cip/6.1 | 4.16 | 6.1.187-cip60 | 211ee5d998d9 |
| cip/6.12 | 4.16 | 6.12.108-cip31 | 972fdf7c4f5c |