---
id: CVE-2026-74748
title: 'netfilter: ipset: fix refcount race between list:set GC and swap'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  netfilter: ipset: fix refcount race between list:set GC and swap

  __ip_set_put_byindex() resolved the index to a set pointer under RCU,
  then took ip_set_ref_lock in __i…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    97a01de0c6321b7210d30d0a4d60f10f561097c7
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    c21afc7c216a4d257a4f3f300e0791890bc846b9
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    b0aab9dd1a348b99d75ff52765719d0cc2050630
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    b891e7a6bb06e0f6560e5932665ac660acd12225
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    20cb13a523f0a05cb2d0a7d72abae687683712e0
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    cb20da33839f28f590c99f16bafaa6151451c0e8
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    24ffcb1e1688c55fd2a505f064295cd28eac546d
  - >-
    Linux >= 9076aea76538556224e7d73ab718f8841330818a <
    0c88868271653537ed443272dd8e7d13634d214b
  - Linux 3.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:16:21.566751Z'
published: '2026-08-26'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T19:26:24.058Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-74748'
references:
  - url: 'https://git.kernel.org/stable/c/97a01de0c6321b7210d30d0a4d60f10f561097c7'
  - url: 'https://git.kernel.org/stable/c/c21afc7c216a4d257a4f3f300e0791890bc846b9'
  - url: 'https://git.kernel.org/stable/c/b0aab9dd1a348b99d75ff52765719d0cc2050630'
  - url: 'https://git.kernel.org/stable/c/b891e7a6bb06e0f6560e5932665ac660acd12225'
  - url: 'https://git.kernel.org/stable/c/20cb13a523f0a05cb2d0a7d72abae687683712e0'
  - url: 'https://git.kernel.org/stable/c/cb20da33839f28f590c99f16bafaa6151451c0e8'
  - url: 'https://git.kernel.org/stable/c/24ffcb1e1688c55fd2a505f064295cd28eac546d'
  - url: 'https://git.kernel.org/stable/c/0c88868271653537ed443272dd8e7d13634d214b'
tags:
  - cve.org
epss: 0.00139
epssPercentile: 0.02896
ingestedAt: '2026-10-16T19:46:24.323Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix refcount race between list:set GC and swap

__ip_set_put_byindex() resolved the index to a set pointer under RCU,
then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.
ip_set_swap() holds that same lock while swapping both the ip_set_list
slots and the two sets' ref counters, so it can interleave between the
dereference and the lock acquisition, leaving the caller to decrement a
set whose reference already moved to the other index and hit
BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,
which the nfnl mutex does not serialize against swap: an expiring
list:set member calls list_set_del() -> ip_set_put_byindex() while
IPSET_CMD_SWAP runs on the referenced sets.

Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()
already does, keeping the refcount tied to the index rather than to a
stale set pointer.

  kernel BUG at net/netfilter/ipset/ip_set_core.c:685!
  Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
  RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870)
  Call Trace:
   <IRQ>
   list_set_del (net/netfilter/ipset/ip_set_list_set.c:159)
   set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181)
   list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578)
   call_timer_fn (kernel/time/timer.c:1748)
   __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374)
   run_timer_softirq (kernel/time/timer.c:2405)
   </IRQ>
  Kernel panic - not syncing: Fatal exception in interrupt

## Affected

- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < 97a01de0c6321b7210d30d0a4d60f10f561097c7`
- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < c21afc7c216a4d257a4f3f300e0791890bc846b9`
- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < b0aab9dd1a348b99d75ff52765719d0cc2050630`
- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < b891e7a6bb06e0f6560e5932665ac660acd12225`
- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < 20cb13a523f0a05cb2d0a7d72abae687683712e0`
- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < cb20da33839f28f590c99f16bafaa6151451c0e8`
- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < 24ffcb1e1688c55fd2a505f064295cd28eac546d`
- `Linux >= 9076aea76538556224e7d73ab718f8841330818a < 0c88868271653537ed443272dd8e7d13634d214b`
- `Linux 3.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.