CVE-2026-74695 Linux CVE debrief

Who should care

Linux kernel maintainers, network administrators, and security teams responsible for managing Linux-based systems, particularly those using netfilter flowtable offload hooks, should assess exposure and apply patches or mitigations as necessary. These teams should review and apply the patches provided by the Linux kernel maintainers, verify the affected versions of the Linux kernel, and update to a patched version if necessary. They should also monitor

Why it matters

The vulnerability in the Linux kernel's netfilter flowtable offload hooks can lead to a reference count leak, causing system crashes and potential elevation of privileges. Linux kernel maintainers, network administrators, and security teams should assess exposure and apply patches or mitigations as necessary.

• Potential denial-of-service (DoS) due to increased memory usage and system crashes.
• Elevation of privileges through exploitation of the vulnerability.
• Information disclosure through analysis of network traffic and system logs.
• Verification of patch application and vulnerability remediation.

Technical summary

The vulnerability is caused by the failure to drop existing skb dst before setting a new one, leading to a reference count leak. This can trigger DEBUG_NET_WARN_ON_ONCE assertions in skb_dst_check_unset(). The issue arises in the Linux kernel's netfilter flowtable offload hooks when incoming skbs pass through these hooks, potentially carrying a ref-counted dst_entry from earlier RX or routing steps. Calling skb_dst_set_noref() on such skbs can overwrite the existing dst_entry reference, leading to a reference count leak. Linux kernel maintainers, network administrators, and security teams should assess exposure and apply patches or mitigations as necessary.

Defensive priority

Medium

Recommended defensive actions

• Review and apply the patches provided by the Linux kernel maintainers.
• Verify the affected versions of the Linux kernel and update to a patched version if necessary.
• Monitor network traffic and system logs for potential exploitation attempts.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and associated source item provide details on the vulnerability, including its description, affected versions, and references to source code changes. The vulnerability was addressed in the Linux kernel's netfilter flowtable offload hooks. The issue arises when incoming skbs pass through these hooks, potentially carrying a ref-counted dst_entry from earlier RX or routing steps. To verify patch application and vulnerability remediation, defenders should review the supplied official advisory or CVE record to validate the

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.