CVE-2026-74347

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount

Add a refcount for struct nf_ct_timeout which is used by ct extension to

set the custom ct timeout policy, this tells us that the ct timeout is

being used by a conntrack entry. When the last conntrack entry drops the

refcount on the ct timeout, the ct timeout is released.

Remove the refcount for control plane which controls if the ruleset

refers to the timeout policy. After this update, it is possible to

remove the ct timeout policy from nfnetlink_cttimeout immediately.

This is for simplicity not to handle two refcounts on a single object.

Remove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just

hold a reference to the nf_ct_timeout object until packet is reinjected,

since this is part of the ct extension, this will be released by the

time the conntrack is freed.

nf_ct_untimeout() is still called to clean up in a best effort

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References