CVE-2026-74695

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()

Incoming skbs passing through netfilter flowtable offload hooks (or XFRM

offload path) might already carry a ref-counted dst_entry assigned during

earlier RX or routing steps.

Calling skb_dst_set_noref() when skb already holds a ref-counted dst

overwrites skb->_skb_refdst, leaking the previous dst_entry reference

count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in

skb_dst_check_unset():

WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170

WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234

WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864

Drop any existing dst_entry reference with skb_dst_drop(skb) before

setting the non-referenced flowtable destination.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References