CVE-2026-74565 Linux CVE debrief

Who should care

Linux kernel maintainers, Linux distribution maintainers, and users of Linux kernel deployments should assess exposure and verify patch deployment to prevent potential use-after-free. This includes reviewing the vulnerability details, understanding the impact on their systems, and taking necessary actions to mitigate the risk. Maintainers and users must work together to ensure that affected systems are patched and that compensating controls are in place to

Why it matters

CVE-2026-74565 is a use-after-free vulnerability in the Linux kernel's netfilter component. Linux kernel maintainers and users should assess exposure and verify patch deployment to prevent potential use-after-free.

• Verify patch deployment for Linux kernel versions to prevent potential use-after-free
• Assess exposure of Linux kernel deployments to CVE-2026-74565
• Monitor Linux kernel updates for potential backports of the fix

Technical summary

The Linux kernel's netfilter component has a use-after-free vulnerability due to a global nft_object rhltable. This allows access to objects being released from the lookup path by other network namespaces, potentially leading to use-after-free of these objects. The issue is addressed by making the rhltable per table, ensuring proper isolation and management of objects within their respective tables. This change prevents unintended access and potential security risks associated with use-after-free vulnerabilities. Users are advised to update to the latest Linux kernel version to apply this fix.

Defensive priority

Linux kernel maintainers and users should assess exposure and verify patch deployment.

Recommended defensive actions

• Assess exposure of Linux kernel deployments to CVE-2026-74565
• Verify patch deployment for Linux kernel versions
• Monitor Linux kernel updates for potential backports
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability. Multiple source references from the Linux kernel Git repository are available. The vulnerability has been resolved in the Linux kernel, and users are advised to update to the latest version to ensure protection. The fix involves making the nft_object rhltable per table to prevent use-after-free vulnerabilities.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.