CVE-2026-74695

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

State: Published
Severity: 7.5 High
Published: Aug 22, 2026
Updated: Oct 30, 2026
Reserved: Aug 15, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps.

Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset():

WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864

Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 763f59b72ddaf18d0750d53083a74355f6c003c8Affected 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 4db3b48a966ed479b99cc8319ea9e46d4f7c703bAffected 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 274f544a32c08638ee887f2e27e3235b6b1237d4Affected 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 12afa450a6a6c0cce2c42b7545a9958f62d8a00cAffected 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 538e67e8c7889cf5f93951f5309d1bcb41f86036Affected 2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 8aecf0bbcc72605592134c917c222207d8f63ab0Affected b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27Affected 209dedf806d31095968f54323dbe62525b077b33Affected 4.16.15 to before 4.17Affected 4.17.1 to before 4.18Affected
LinuxLinux	4.18Affected before 4.18Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.45 through 6.18.Not affected 7.1.9 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 763f59b72ddaf18d0750d53083a74355f6c003c8Affected
2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 4db3b48a966ed479b99cc8319ea9e46d4f7c703bAffected
2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 274f544a32c08638ee887f2e27e3235b6b1237d4Affected
2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 12afa450a6a6c0cce2c42b7545a9958f62d8a00cAffected
2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 538e67e8c7889cf5f93951f5309d1bcb41f86036Affected
2a79fd3908acd88e6cb0e620c314d7b1fee56a02 to before 8aecf0bbcc72605592134c917c222207d8f63ab0Affected
b4b1adf2e66ecc7125c4117e7aad9ff61e2cfd27Affected
209dedf806d31095968f54323dbe62525b077b33Affected
4.16.15 to before 4.17Affected
4.17.1 to before 4.18Affected

LinuxLinux

4.18Affected
before 4.18Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.45 through 6.18.*Not affected
7.1.9 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.