---
id: CVE-2026-74746
title: 'netfilter: flowtable: publish GC-visible tuple last'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: flowtable: publish GC-visible tuple last

  nf_flow_table_iterate() only treats original-direction tuple nodes as
  owning entries. Publishing the original node …
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    0a00254585827f1695aa2700114af622ea754cfa
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    be345dcbddb4643a54252b954af974b16eda8f91
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    211ee5d998d92a7d548811939c65942d06c146e4
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    972fdf7c4f5c282a239c88fea614b056c33dc025
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    d9d3050a70efe217e73a0751e55fdae6a7092620
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    d16b71231e65cb05daea2b45701fcf09cef041e7
  - >-
    Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e <
    2014ac62df9d45bb9a004a043e85df7be09ed780
  - Linux 4.16
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-16T19:16:14.907909Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:23.781Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74746'
references:
  - url: 'https://git.kernel.org/stable/c/0a00254585827f1695aa2700114af622ea754cfa'
  - url: 'https://git.kernel.org/stable/c/be345dcbddb4643a54252b954af974b16eda8f91'
  - url: 'https://git.kernel.org/stable/c/211ee5d998d92a7d548811939c65942d06c146e4'
  - url: 'https://git.kernel.org/stable/c/d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2'
  - url: 'https://git.kernel.org/stable/c/972fdf7c4f5c282a239c88fea614b056c33dc025'
  - url: 'https://git.kernel.org/stable/c/d9d3050a70efe217e73a0751e55fdae6a7092620'
  - url: 'https://git.kernel.org/stable/c/d16b71231e65cb05daea2b45701fcf09cef041e7'
  - url: 'https://git.kernel.org/stable/c/2014ac62df9d45bb9a004a043e85df7be09ed780'
tags:
  - cve.org
epss: 0.00536
epssPercentile: 0.43958
ingestedAt: '2026-10-16T19:46:24.323Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: flowtable: publish GC-visible tuple last

nf_flow_table_iterate() only treats original-direction tuple nodes as
owning entries. Publishing the original node first lets GC observe and
free a flow while flow_offload_add() is still inserting the reply node.
Publish the reply node first and the original node last so GC never
sees a partially installed flow.

KASAN can trigger slab-use-after-free read and write reports in the
flowtable/rhashtable path (rht_deferred_worker, jhash, flow_offload_del,
flow_offload_lookup, etc.).

## Affected

- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < 0a00254585827f1695aa2700114af622ea754cfa`
- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < be345dcbddb4643a54252b954af974b16eda8f91`
- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < 211ee5d998d92a7d548811939c65942d06c146e4`
- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < d37917e7bebe078f3c17e47fd6fc1c9f6e8497b2`
- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < 972fdf7c4f5c282a239c88fea614b056c33dc025`
- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < d9d3050a70efe217e73a0751e55fdae6a7092620`
- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < d16b71231e65cb05daea2b45701fcf09cef041e7`
- `Linux >= ac2a66665e231847cab11b8c8e844ce43207dd2e < 2014ac62df9d45bb9a004a043e85df7be09ed780`
- `Linux 4.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.