CVE-2026-74625

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-74625
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74625.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-74625
Downstream
Published
2026-08-22T15:32:07.929Z
Modified
2026-08-24T11:47:03.825292386Z
Summary
netfilter: bridge: release template ct on non-IP path
Details

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: release template ct on non-IP path

A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre() currently overwrites skb->nfct with IPCT_UNTRACKED without releasing the existing template reference.

That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.

Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/74xxx/CVE-2026-74625.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
3c171f496ef57774f8e5d509923372549734877f
Fixed
fc90df37540627d092af770215fb4b7befe9409b
Fixed
daa6e070f8e1e7a4dddec8b64ca37663f8cda917
Fixed
bd7b16494dacf87e9336a1dcfdada83b9e40edd6
Fixed
6ea88401e10e04e0b3bb7a7adea54932fb60b93b
Fixed
46d559f00b1ab1d114f92d2f16c5ef0093b3b9dd
Fixed
c58d34fe8b7e47bb0b350a7625023b1261342be5
Fixed
7cff440d702616022769f2643168d7f9820547a0
Fixed
d45cc8020d7c0a9f01dee42ff5c40bc14c9af72f

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74625.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.3.0
Fixed
5.10.265
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.216
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.183
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.152
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.104
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.45
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-74625.json"