CVE-2026-74492

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter ipset component where mtype resize() copies comment pointers using memcpy() instead of copying the actual comment objects. This creates a race condition during the window after an entry is copied but before the table swap and backlog replay. If a packet-side add occurs via xt SET --add-set ... --exist and hits an old entry, the mtype add() function calls ip set init comment(), which frees the shared comment. Consequently, the replacement-table entry is left with a stale pointer. When the queued add is later replayed on the new table, mtype add() calls ip set init comment() again, leading to a memory dereference of the stale pointer via strlen().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.