CVE-2026-74625: netfilter: bridge: release template ct on non-IP path
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: release template ct on non-IP path
A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre() currently overwrites skb->nfct with IPCTUNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.
Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.152.1-1
Event History
Frequently Asked Questions
Which systems are exposed to this memory leak?
Systems using bridge nftables with a conntrack zone set rule are exposed when they process frames with EtherTypes other than IPv4 or IPv6. The issue occurs on the bridge netfilter non-IP processing path.
What traffic is needed to trigger the issue?
An attacker or traffic source needs to send non-IPv4, non-IPv6 Ethernet frames through a bridge where a nftables ct zone set rule has attached a conntrack template. Repeated triggering can leak conntrack-template memory until slab memory is exhausted.
Is a default Linux bridge configuration affected?
The described condition requires a bridge nftables ct zone set rule. The provided information does not indicate that this rule is present in a default configuration.
What can be done if the fix cannot be deployed immediately?
Avoid applying bridge nftables ct zone set rules to traffic that can include non-IPv4 or non-IPv6 EtherTypes, or restrict such EtherTypes from traversing the affected bridge. Monitor slab memory usage for growth if the affected configuration must remain enabled.