CVE-2026-74748 Linux CVE debrief

Who should care

Linux kernel developers, administrators, and users who rely on the netfilter: ipset subsystem for network filtering and IP set management should be aware of this vulnerability. They should review and apply kernel updates to ensure the latest fixes are applied and monitor system logs for potential crashes or errors related to the netfilter: ipset subsystem. Additionally, they should verify that affected systems are running a patched kernel version.

Why it matters

A refcount race condition in the Linux kernel's netfilter: ipset subsystem can cause kernel crashes, requiring verification of kernel patching and monitoring of system logs.

• Potential kernel crashes or instability
• Verification of kernel patching and update processes
• Monitoring of system logs for related errors

Technical summary

The vulnerability is caused by a refcount race condition between list:set GC and swap in the Linux kernel's netfilter: ipset subsystem. This can lead to a kernel crash when the caller decrements a set whose reference has already moved to another index. The issue arises from the incorrect handling of set references during the swap operation. To fix this vulnerability, kernel updates should be reviewed and applied to ensure the latest fixes are applied. The affected systems should be verified to be running a patched kernel version.

Defensive priority

Medium

Recommended defensive actions

• Review and apply kernel updates to ensure the latest fixes are applied
• Monitor system logs for potential crashes or errors related to the netfilter: ipset subsystem
• Verify that affected systems are running a patched kernel version
• Perform a thorough review of the system's network filtering configurations
• Check for any potential exposure to the vulnerability
• Implement compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and source item provide details about the vulnerability, including its description, affected versions, and references to kernel commits that address the issue. The Linux kernel's netfilter: ipset subsystem is vulnerable to a refcount race condition between list:set GC and swap. The issue is caused by the incorrect handling of set references during the swap operation. The kernel commits addressing the issue are referenced in the CVE record and source item.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.