CVE-2026-74662: inet: frags: publish queues before arming timer
In the Linux kernel, the following vulnerability has been resolved:
inet: frags: publish queues before arming timer
inetfragcreate() arms the fragment queue timer before inserting the queue into the fqdir rhashtable. If the namespace fragment timeout is zero or negative, the timer can run before the queue is published.
The timer callback then marks the queue complete, tries to remove a node that is not in the hash table yet, and drops the anticipated hash reference. Creation can subsequently publish the completed queue without restoring that reference, leaving a stale hash node after the caller drops the remaining reference.
Publish the queue first and arm the timer while holding the queue lock. This makes timer expiry wait until the queue is visible in the hash table, so inetfragkill() can remove the node and balance the hash reference.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.157.1-1
Event History
Frequently Asked Questions
Which deployments are affected by the race condition?
The vulnerable path is triggered when the network namespace fragment timeout is configured to zero or a negative value. Under that condition, the fragment queue timer can expire before the queue is visible in the fragment-queue hash table.
What can happen if the race is triggered?
A completed fragment queue can be published with an unbalanced hash reference, leaving a stale node in the hash table after the caller releases its remaining reference.
Are specific fixed Linux kernel versions listed?
No fixed kernel version numbers are provided. The available remediation references are three stable kernel commits: 9f904dd3e455750e5d4ec9b2f134835811b85a2f, 928128865e43b197e30688dc1bc991592c97edcf, and 653d7ddf6cba867777a3d14c4f83ace008c5ad13.