CVE-2026-74625: netfilter: bridge: release template ct on non-IP path

Published Aug 22, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bridge: release template ct on non-IP path

A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre() currently overwrites skb->nfct with IPCTUNTRACKED without releasing the existing template reference.

That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.

Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.

Affected Software

1 affected component

Linux Linux kernel

Event History

Aug 22, 2026

CVE Published

via MITRE·03:32 PM

Data Sourced

via MITRE·03:32 PM

Description

Data Sourced

via NVD·04:16 PM

Description

Frequently Asked Questions

Which systems are exposed to this memory leak?

Systems using bridge nftables with a conntrack zone set rule are exposed when they process frames with EtherTypes other than IPv4 or IPv6. The issue occurs on the bridge netfilter non-IP processing path.

What traffic is needed to trigger the issue?

An attacker or traffic source needs to send non-IPv4, non-IPv6 Ethernet frames through a bridge where a nftables ct zone set rule has attached a conntrack template. Repeated triggering can leak conntrack-template memory until slab memory is exhausted.

Is a default Linux bridge configuration affected?

The described condition requires a bridge nftables ct zone set rule. The provided information does not indicate that this rule is present in a default configuration.

What can be done if the fix cannot be deployed immediately?

Avoid applying bridge nftables ct zone set rules to traffic that can include non-IPv4 or non-IPv6 EtherTypes, or restrict such EtherTypes from traversing the affected bridge. Monitor slab memory usage for growth if the affected configuration must remain enabled.

CVE-2026-74625: netfilter: bridge: release template ct on non-IP path

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this memory leak?

What traffic is needed to trigger the issue?

Is a default Linux bridge configuration affected?

What can be done if the fix cannot be deployed immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this memory leak?

What traffic is needed to trigger the issue?

Is a default Linux bridge configuration affected?

What can be done if the fix cannot be deployed immediately?