Netfilter Vulnerability in Linux Kernel Affecting Traffic Management

CVE-2026-74695

What is CVE-2026-74695?

A vulnerability exists in the Linux kernel's netfilter subsystem that could lead to a reference count leak due to improper handling of a socket buffer's destination entry. Specifically, when incoming socket buffers (skbs) pass through netfilter's flowtable offload hooks, they may already carry a reference-counted destination entry assigned during prior receive or routing processes. The call to skb_dst_set_noref() overwrites the existing reference count without dropping the previous entry, which results in a leak and can trigger warnings during network operations. The issue highlights the importance of dropping any existing reference before assigning a new one to maintain system integrity and stability.

References