CVE-2026-74625
In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference. That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab. Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.
Affected versions
Linux kernel versions
5.3
and later are affected. Fixed in
5.10.265,
5.15.216,
6.1.183,
6.6.152,
6.12.104,
6.18.45,
7.1.9,
7.2
and their respective stable series.
References
8 totalFrequently asked questions
-
What is CVE-2026-74625?
CVE-2026-74625 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.3 onward and has been patched in 5.10.265, 5.15.216, 6.1.183 and others. CVE-2026-74625 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74625?
Yes. CVE-2026-74625 has been patched. Fixed versions include 5.10.265, 5.15.216, 6.1.183 and others. If you are running Linux kernel 5.3 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74625 actively exploited?
No. CVE-2026-74625 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.