CVE-2026-74746

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last

nfflowtableiterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffload_add() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.

KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rhtdeferredworker, jhash, flowoffloaddel, flowoffloadlookup, etc.).