CVE-2026-74625— netfilter: bridge: release template ct on non-IP path
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： netfilter：bridge：在非 IP 路径上释放 conntrack 模板引用 当设置桥接 nftables 的 conntrack 区域（ct zone）规则时，可能会在 函数处理之前，将 conntrack 模板附加到 sk_buff（skb）结构上。对于非 IPv4 和非 IPv6 的 EtherType 类型的数据帧， 当前会将 覆盖为 （未跟踪状态），但并未释放已有的模板引用。 这导致每 CPU 模板以及为并发使用而分配的临时模板变得无法访问，从而造成
Possible ATT&CK Techniques 1 AI
T1496 · Resource HijackingAffected Version Matrix 18
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 3c171f496ef57774f8e5d509923372549734877f< fc90df37540627d092af770215fb4b7befe9409b |
affected |
3c171f496ef57774f8e5d509923372549734877f< daa6e070f8e1e7a4dddec8b64ca37663f8cda917 |
affected | ||
3c171f496ef57774f8e5d509923372549734877f< bd7b16494dacf87e9336a1dcfdada83b9e40edd6 |
affected | ||
3c171f496ef57774f8e5d509923372549734877f< 6ea88401e10e04e0b3bb7a7adea54932fb60b93b |
affected | ||
3c171f496ef57774f8e5d509923372549734877f< 46d559f00b1ab1d114f92d2f16c5ef0093b3b9dd |
affected | ||
3c171f496ef57774f8e5d509923372549734877f< c58d34fe8b7e47bb0b350a7625023b1261342be5 |
affected | ||
3c171f496ef57774f8e5d509923372549734877f< 7cff440d702616022769f2643168d7f9820547a0 |
affected | ||
3c171f496ef57774f8e5d509923372549734877f< d45cc8020d7c0a9f01dee42ff5c40bc14c9af72f |
affected | ||
| … +10 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-74625
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
netfilter: bridge: release template ct on non-IP path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
netfilter: bridge: release template ct on non-IP path
A bridge nftables ct zone set rule can attach a conntrack template to
an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6
EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with
IP_CT_UNTRACKED without releasing the existing template reference.
That makes the per-cpu template, and any temporary templates allocated
for concurrent use, unreachable and leaks memory until the host runs out
of slab.
Reset the skb conntrack state before marking the frame untracked so the
existing template reference is dropped on the non-IP path.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-74625
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-74625
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-74625 (8)
Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total
| CVE-2026-74640 | ALSA: FCP: fix OOB write in fcp_meter_ctl_get() | |
| CVE-2026-74621 | net/sched: act_ct: fix sk_buff leak when the header checks reject a packet | |
| CVE-2026-74622 | net: atlantic: free RX pages of consumed but not refilled buffers | |
| CVE-2026-74623 | net: atlantic: free stranded TX buffers on ring deinit | |
| CVE-2026-74624 | netfilter: nf_conntrack: defer invalid log until after unlock | |
| CVE-2026-74627 | net: devmem: prevent net-iov / page mixing | |
| CVE-2026-74626 | NTB: ntb_netdev: Preserve RX queue depth on allocation failure | |
| CVE-2026-74628 | net/x25: fix use-after-free of the socket by its timers | |
| CVE-2026-74629 | net/dibs: Correct freeing of dmb_clientid_arr | |
| CVE-2026-74631 | net: smc: fix splice entry lifetime imbalance in smc_rx_splice | |
| CVE-2026-74630 | ipv6: prevent in6_dev_get() from resurrecting inet6_dev | |
| CVE-2026-74632 | mm/huge_memory: fix huge_zero_pfn race | |
| CVE-2026-74633 | tracing: Fix NULL pointer dereference in module event cache removal | |
| CVE-2026-74634 | ring-buffer: Prevent subbuf order change when resizing is disabled | |
| CVE-2026-74635 | fbdev: bitblit: bound-check glyph index in bit_cursor() | |
| CVE-2026-74636 | tracing: Fix race between update_event_fields and, event_define_fields | |
| CVE-2026-74637 | perf/core: Fix group leader use-after-free after sibling detach | |
| CVE-2026-74639 | ALSA: us144mkii: re-anchor capture URBs on resubmission | |
| CVE-2026-74638 | drm/v3d: Serialize the scheduler timeout handlers | |
| CVE-2026-74651 | staging: rtl8723bs: fix OOB read in rtw_get_wpa_ie() |
Showing top 20 of 150 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
Same vendor: Linux
-
CVE-2026-74733
gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock -
CVE-2026-74732
drm/amd/display: Check for tg ops in dce110_set_avmute -
CVE-2026-74731
sched_ext: Skip sub-disable teardown for never-linked sub-sc -
CVE-2026-74730
NFS: Pin the 'struct nfs_server' during a FREE_STATEID call -
CVE-2026-74729
soc: aspeed: lpc-snoop: Fix usercopy overflow in snoop_file_
V. Comments for CVE-2026-74625
No comments yet