CVE-2026-74746

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the netfilter flowtable where the nf flow table iterate() function only treats original-direction tuple nodes as owning entries. This allows the Garbage Collector (GC) to observe and free a flow while flow offload add() is still inserting the reply node. This race condition can lead to slab-use-after-free read and write operations within the flowtable/rhashtable path, specifically affecting functions such as rht deferred worker(), jhash(), flow offload del(), and flow offload lookup().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.