Look up another CVE · open CVE-2026-74347 in the interactive tracker
CVE-2026-74347
netfilter: cttimeout: detach dataplane timeout policy and repurpose refcount
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem include/net. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74347 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | fixedDSA-6568-1 · 2026-10-16 · text | 6.12.113-1 | Update the kernel and reboot. DSA-6568-1 shipped the fix on 2026-10-16, in 6.12.113-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.5-1 | Update the kernel and reboot. Fixed in 7.1.5-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
Add a refcount for struct nf_ct_timeout which is used by ct extension to set the custom ct timeout policy, this tells us that the ct timeout is being used by a conntrack entry. When the last conntrack entry drops the refcount on the ct timeout, the ct timeout is released. Remove the refcount for control plane which controls if the ruleset refers to the timeout policy. After this update, it is possible to remove the ct timeout policy from nfnetlink_cttimeout immediately. This is for simplicity not to handle two refcounts on a single object. Remove nf_queue_nf_hook_drop(): a packet sitting in nfqueue will just hold a reference to the nf_ct_timeout object until packet is reinjected, since this is part of the ct extension, this will be released by the time the conntrack is freed. nf_ct_untimeout() is still called to clean up in a best effort basis: the ct timeout on existing entries gets removed when the ct timeout goes away, but as long as the iptables ruleset still refers to the ct timeout through a template, new conntracks may keep attaching it and extend its lifetime until the rule is removed. nf_ct_untimeout() is not called anymore from module removal path, this is unlikely to find timeouts give module refcount is bumped, and the new refcount already tracks the ct timeout policy use so it is released when unused.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
include/net/netfilter/nf_conntrack_timeout.h
net/netfilter/nf_conntrack_core.c
net/netfilter/nf_conntrack_timeout.c
net/netfilter/nfnetlink_cttimeout.c
net/netfilter/nft_ct.c
net/netfilter/xt_CT.c
- What this is
- NETFILTERMAINTAINERS section matched on include/net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
- Kernel module
- nf_conntrack
Check it on the machine
grep -wE 'CONFIG_NETFILTER|CONFIG_NF_CONNTRACK' /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w nf_conntrackPrints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this as a loadable module. Every release below compiles it as a module on every flavour, so whether the code is in the running kernel depends on whether that module is loaded.
- bookworm, trixie, forky, sidm
- m
- a loadable module on every flavour - check lsmod, can be blacklisted
- Build switches
- CONFIG_NETFILTER, CONFIG_NF_CONNTRACK
- Reads as
- all on means the file is compiled; any one off means it is not.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.13%, higher than 2.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- include/net
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 3.4 | 6.12.112 | b2e84317f334 |
| 3.4 | 6.18.53 | 44583fd5735c |
| 3.4 | 7.1.5 | 9aeb0dcfeb46 |
| 3.4 | 7.2 | 7d6a9cdb8d3a |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DSA-6568-1 | 2026-10-16 | trixie 6.12.113-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- Exploitation requires netlink control-plane operations (nfnetlink_cttimeout delete, nftables timeout object destroy, or iptables CT template removal) gated by CAP_NET_ADMIN; the UAF is exercised in local conntrack packet handling, not by unauthenticated remote packets alone.
- AC:LAttack complexity, low
- An attacker with namespace admin can create timeout policies, drive concurrent conntrack traffic on multiple CPUs, and delete or replace the policy while packets still read it via RCU in nf_conntrack_tcp_packet; they control both teardown and dataplane readers.
- PR:LPrivileges required, low
- All trigger paths require CAP_NET_ADMIN for nfnetlink/nftables/iptables configuration; netlink_net_capable() checks capability against the socket network namespace user_ns, so unprivileged local users can obtain it via user and network namespaces on common kernels.
- UI:NUser interaction, none
- No victim interaction is required; the attacker configures timeout policies, generates matching traffic, and tears down the policy while conntrack handlers still reference it, fully driving the race themselves.
- S:UScope, unchanged
- Impact is kernel heap corruption within the netfilter/conntrack subsystem of the same kernel security authority; it does not cross VM, hypervisor, or IOMMU isolation boundaries.
- C:HConfidentiality impact, high
- This is a slab use-after-free of nf_ct_timeout objects still dereferenced through RCU in nf_ct_timeout_lookup() during TCP/UDP/SCTP conntrack handlers; freed objects can be reallocated to obtain arbitrary kernel memory read primitives.
- I:HIntegrity impact, high
- UAF of heap-allocated timeout policy data enables heap spraying and object replacement to corrupt adjacent structures or control flow, supporting arbitrary kernel write and local privilege escalation.
- A:HAvailability impact, high
- Concurrent readers of freed timeout policy memory in nf_conntrack_tcp_packet and related handlers can trigger KASAN slab-use-after-free faults and kernel oops or panic, as demonstrated in the closely related nft_ct timeout destroy report.