CVE-2026-74695 netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
A missing reference count drop in Linux kernel netfilter flowtable offload causes memory leaks and kernel warnings, potentially leading to denial of service.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74695?
CVE-2026-74695 is a high-severity memory corruption vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps.
Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset():
WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.
Which versions are affected by CVE-2026-74695?
How do I fix CVE-2026-74695?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-74695 being exploited?
There is no known exploitation of CVE-2026-74695 in the wild and no public exploit code.
Sources
Also known as AZL-97100, BELL-CVE-2026-74695, DEBIAN-CVE-2026-74695, GHSA-cx4h-xjm7-pqxp, UBUNTU-CVE-2026-74695.