CVE-2026-74748

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the netfilter ipset component between the list:set garbage collection (GC) and the swap operation. The function ip set put byindex() resolves an index to a set pointer under RCU and subsequently acquires the ip set ref lock to decrement the set->ref counter. However, ip set swap() can interleave between these two steps while holding the same lock to swap list slots and reference counters. This can lead to the decrement of a reference counter for a set that has already moved to another index, potentially triggering a kernel panic via BUG ON(set->ref == 0). This scenario occurs when an expiring list:set member calls list set del() through list set gc() via a timer softirq while an IPSET CMD SWAP operation is executing on the referenced sets.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.