CVE-2026-74746 netfilter: flowtable: publish GC-visible tuple last
A race condition in the Linux kernel netfilter flowtable allows garbage collection to free a flow during insertion, leading to use-after-free and potential code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-74746?
CVE-2026-74746 is a critical use after free vulnerability in Linux, published on 26 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish GC-visible tuple last
nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
Which versions are affected by CVE-2026-74746?
How do I fix CVE-2026-74746?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-74746 being exploited?
There is no known exploitation of CVE-2026-74746 in the wild and no public exploit code.
Sources
Also known as AZL-97821, BELL-CVE-2026-74746, DEBIAN-CVE-2026-74746, GHSA-4hwc-233g-5mv3, UBUNTU-CVE-2026-74746.