CVE-2026-74695: netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nfflowtable: drop existing skb dst before skbdstsetnoref()
Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dstentry assigned during earlier RX or routing steps.
Calling skbdstsetnoref() when skb already holds a ref-counted dst overwrites skb->skbrefdst, leaking the previous dstentry reference count and triggering a DEBUGNETWARNONONCE assertion in skbdstcheckunset():
WARNING: at skbdstcheckunset include/linux/skbuff.h:1170 WARNING: at skbdstsetnoref include/linux/skbuff.h:1234 WARNING: at nfflowoffloadiphook+0xf6c/0x2b60 net/netfilter/nfflowtableip.c:864
Drop any existing dstentry reference with skbdstdrop(skb) before setting the non-referenced flowtable destination.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.45 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.1.9 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.9-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
In the Linux kernel netfilter nf_flow_table flowtable offload and XFRM offload paths, call skb_dst_drop(skb) to drop any existing dst_entry reference before calling skb_dst_set_noref().
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems whose incoming packets traverse netfilter flowtable offload hooks or the XFRM offload path may be exposed, particularly when those packets already carry a ref-counted dst_entry from earlier receive or routing processing.
What does triggering the flaw require?
A packet must reach the affected flowtable or XFRM offload processing path with an existing ref-counted destination entry. The vulnerable handling overwrites that destination state with a non-referenced flowtable destination without first releasing the prior reference.
How can I identify signs of exposure?
With kernel debug checks enabled, affected processing can produce a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset(), with warnings referencing skb_dst_set_noref() and nf_flow_offload_ip_hook. The condition also leaks the previous dst_entry reference count.
What mitigation is indicated by the available information?
Apply a kernel update containing the fix that calls skb_dst_drop(skb) before assigning the non-referenced flowtable destination. The provided data does not specify a configuration-only workaround.