Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74748— netfilter: ipset: fix refcount race between list:set GC and swap

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述信息的中文翻译： 在 Linux 内核中，以下漏洞已得到修复： netfilter: ipset: 修复 list:set 垃圾回收（GC）与交换（swap）之间的引用计数竞态条件 在 RCU 保护下将索引解析为 set 指针，随后在 中获取 以减少 。 而 在执行交换 槽位以及两个 set 的引用计数器时持有同一把锁，因此它可能会在“指针解引用”与“获取锁”之间插入执行，导致调用者去减少一个引用计数已经转移到另一个索引的 set，从而触发 。 通过定时器软中断（timer softirq）进入该路

CVSS 7.8 · High EPSS 0.14% · P4

Possible ATT&CK Techniques 1 AI

T1202 · Indirect Command Execution

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 9076aea76538556224e7d73ab718f8841330818a< 97a01de0c6321b7210d30d0a4d60f10f561097c7 affected
9076aea76538556224e7d73ab718f8841330818a< c21afc7c216a4d257a4f3f300e0791890bc846b9 affected
9076aea76538556224e7d73ab718f8841330818a< b0aab9dd1a348b99d75ff52765719d0cc2050630 affected
9076aea76538556224e7d73ab718f8841330818a< b891e7a6bb06e0f6560e5932665ac660acd12225 affected
9076aea76538556224e7d73ab718f8841330818a< 20cb13a523f0a05cb2d0a7d72abae687683712e0 affected
9076aea76538556224e7d73ab718f8841330818a< cb20da33839f28f590c99f16bafaa6151451c0e8 affected
9076aea76538556224e7d73ab718f8841330818a< 24ffcb1e1688c55fd2a505f064295cd28eac546d affected
9076aea76538556224e7d73ab718f8841330818a< 0c88868271653537ed443272dd8e7d13634d214b affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74748

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
netfilter: ipset: fix refcount race between list:set GC and swap
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -> ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets. Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap() already does, keeping the refcount tied to the index rather than to a stale set pointer. kernel BUG at net/netfilter/ipset/ip_set_core.c:685! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870) Call Trace: <IRQ> list_set_del (net/netfilter/ipset/ip_set_list_set.c:159) set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181) list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578) call_timer_fn (kernel/time/timer.c:1748) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374) run_timer_softirq (kernel/time/timer.c:2405) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 9076aea76538556224e7d73ab718f8841330818a ~ 97a01de0c6321b7210d30d0a4d60f10f561097c7 -
Linux Linux 3.8 -

II. Public POCs for CVE-2026-74748

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74748

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74748 (8)

Same Patch Batch · Linux · 2026-08-26 · 92 CVEs total

CVE-2026-80557 9.8 CRITICAL libceph: fix OOB read in decode_watchers() via missing bounds check
CVE-2026-74752 9.8 CRITICAL sctp: validate cookie AUTH state before use
CVE-2026-80586 9.8 CRITICAL mptcp: options: reset DSS fields in case of unexpected size
CVE-2026-80519 9.8 CRITICAL ovpn: finish crypto callback cleanup before peer release
CVE-2026-80561 9.8 CRITICAL libceph: fix multiple unsafe decodes in decode_locker()
CVE-2026-74746 9.8 CRITICAL netfilter: flowtable: publish GC-visible tuple last
CVE-2026-74744 9.8 CRITICAL ipvlan: inherit needed_headroom and needed_tailroom from phy_dev
CVE-2026-74743 9.8 CRITICAL macvlan: inherit needed_headroom and needed_tailroom from lowerdev
CVE-2026-80528 9.8 CRITICAL ceph: avoid fs reclaim while using current->journal_info
CVE-2026-80587 9.8 CRITICAL mptcp: avoid combining some incoming suboptions
CVE-2026-80558 9.8 CRITICAL libceph: Avoid using invalid osd indices from primary_temp
CVE-2026-74737 9.8 CRITICAL net: ethernet: ti: am65-cpsw-nuss: Fix port_id extraction from SRC TAG
CVE-2026-80589 9.8 CRITICAL block: stop the timeout timer when releasing a never added disk
CVE-2026-80585 9.4 CRITICAL mptcp: fastopen: only mark MPTFO subflows with SYN data
CVE-2026-74751 9.4 CRITICAL riscv: lib: Fix ZBB strnlen reading past count boundary
CVE-2026-80554 9.3 CRITICAL s390/vfio_ccw: Limit the number of channel program segments
CVE-2026-80551 9.3 CRITICAL s390/vfio_ccw: Ensure first IDAW remains constant
CVE-2026-80576 8.8 HIGH drm/amdgpu: reject oversized IBs with per-ring packet limits
CVE-2026-80553 8.8 HIGH s390/vfio_ccw: Cancel existing workqueues
CVE-2026-80547 8.8 HIGH s390/vfio_ccw: Implement a crw lock

Showing top 20 of 92 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74748

No comments yet

Leave a comment