CVE-2026-74748

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix refcount race between list:set GC and swap

__ip_set_put_byindex() resolved the index to a set pointer under RCU,

then took ip_set_ref_lock in __ip_set_put() to decrement set->ref.

ip_set_swap() holds that same lock while swapping both the ip_set_list

slots and the two sets' ref counters, so it can interleave between the

dereference and the lock acquisition, leaving the caller to decrement a

set whose reference already moved to the other index and hit

BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq,

which the nfnl mutex does not serialize against swap: an expiring

list:set member calls list_set_del() -> ip_set_put_byindex() while

IPSET_CMD_SWAP runs on the referenced sets.

Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap()

already does, keeping the refcount tied to the index rather than to a

stale set pointer.

kernel BUG at net/netfilter/ipset/ip_set_

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References