In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last

nf_flow_table_iterate() only treats original-direction tuple nodes as
owning entries. Publishing the original node first lets GC observe and
free a flow while flow_offload_add() is still inserting the reply node.
Publish the reply node first and the original node last so GC never
sees a partially installed flow.

KASAN can trigger slab-use-after-free read and write reports in the
flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del,
flow_offload_lookup, etc.).

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

No data.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/0a00254585827f1695aa2700114af622ea754cfa cve-icon cve-icon
https://git.kernel.org/stable/c/2014ac62df9d45bb9a004a043e85df7be09ed780 cve-icon cve-icon
https://git.kernel.org/stable/c/211ee5d998d92a7d548811939c65942d06c146e4 cve-icon cve-icon
https://git.kernel.org/stable/c/972fdf7c4f5c282a239c88fea614b056c33dc025 cve-icon cve-icon
https://git.kernel.org/stable/c/be345dcbddb4643a54252b954af974b16eda8f91 cve-icon cve-icon
https://git.kernel.org/stable/c/d16b71231e65cb05daea2b45701fcf09cef041e7 cve-icon cve-icon
https://git.kernel.org/stable/c/d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2 cve-icon cve-icon
https://git.kernel.org/stable/c/d9d3050a70efe217e73a0751e55fdae6a7092620 cve-icon cve-icon
History

Wed, 26 Aug 2026 15:45:00 +0000

Type Values Removed Values Added
Weaknesses CWE-416

Wed, 26 Aug 2026 14:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flow_offload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow. KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del, flow_offload_lookup, etc.).
Title netfilter: flowtable: publish GC-visible tuple last
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-26T14:36:55.963Z

Reserved: 2026-08-15T05:44:03.931Z

Link: CVE-2026-74746

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-26T15:16:53.503

Modified: 2026-08-26T15:16:53.503

Link: CVE-2026-74746

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-26T15:30:05Z

Weaknesses