CVE-2026-74746: netfilter: flowtable: publish GC-visible tuple last
In the Linux kernel, the following vulnerability has been resolved:
netfilter: flowtable: publish GC-visible tuple last
nfflowtableiterate() only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd() is still inserting the reply node. Publish the reply node first and the original node last so GC never sees a partially installed flow.
KASAN can trigger slab-use-after-free read and write reports in the flowtable/rhashtable path (rhtdeferredworker, jhash, flowoffloaddel, flowoffloadlookup, etc.).
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux kernel netfilter flowtable functionality are relevant. The race occurs while a flow is being added and garbage collection can inspect the flowtable.
What timing is required for the bug to occur?
Garbage collection must observe the original-direction tuple after it is published but before the reply-direction tuple has been inserted. In that window, GC can treat the partially installed flow as an owned entry and free it.
What evidence might indicate this issue has occurred?
KASAN may report slab use-after-free reads or writes involving the flowtable and rhashtable paths. Reported functions can include rht_deferred_worker, jhash, flow_offload_del, and flow_offload_lookup.
How can I verify that a kernel source tree includes the fix?
The corrected behavior publishes the reply-direction tuple before publishing the original-direction tuple, preventing GC from seeing a partially installed flow. The listed stable-kernel references identify commits containing this change.