Look up another CVE · open CVE-2026-74492 in the interactive tracker
CVE-2026-74492
netfilter: ipset: do not update comments from kernel-side hash adds
Published 2026-08-15 (2 months ago) by the Linux kernel CNA. Subsystem net/netfilter. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-74492 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | fixedDLA-4777-1 · 2026-09-08 · text | 6.1.187-1 | Update the kernel and reboot. DLA-4777-1 shipped the fix on 2026-09-08, in 6.1.187-1. A running kernel keeps the old code until the machine restarts. |
| Debian 13trixie | fixedDSA-6466-1 · 2026-08-25 · text | 6.12.105-1 | Update the kernel and reboot. DSA-6466-1 shipped the fix on 2026-08-25, in 6.12.105-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.8-1 | Update the kernel and reboot. Fixed in 7.1.8-1. A running kernel keeps the old code until the machine restarts. |
| Debian 12bookworm · linux-6.12 | fixedDLA-4788-1 · 2026-09-19 · text | 6.12.107-1~deb12u1 | Update the kernel and reboot. DLA-4788-1 shipped the fix on 2026-09-19, in 6.12.107-1~deb12u1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
mtype_resize() copies comment pointers with memcpy(), not the comment objects themselves. During the window after an entry has been copied but before the table swap and backlog replay, the old table is still published for packet-side updates while the replacement-table entry already holds the same ip_set_comment_rcu pointer. If xt_SET --add-set ... --exist hits that old entry in this window, mtype_add() calls ip_set_init_comment() even though packet-side adds carry no comment payload. That call frees the shared comment through the old entry, so the replacement-table entry now holds a stale pointer. When the queued add is replayed on the new table, mtype_add() calls ip_set_init_comment() again and strlen() dereferences the stale pointer. Fix this in mtype_add() by skipping ip_set_init_comment() when ext->target marks a packet-side add. Userspace adds still update comments, while packet-side adds can no longer free comment storage shared with a resize copy.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
net/netfilter/ipset/ip_set_hash_gen.h
- What this is
- NETFILTERMAINTAINERS section matched on net/netfilter/ · netfilter-devel@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Not established. This site could not find the build rule for the affected file in the kernel trees Debian ships, so it has no answer about whether Debian compiles this code. Read that as unknown, never as absent.
- bookworm, trixie, forky, sid, bookworm · linux-6.12?
- ?
- not established - no Makefile entry for the affected file
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS
Signals
- Published
- 2026-08-15 (2 months ago)source
- CVSS
- 8.4 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.14%, higher than 3.1% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- net/netfilter
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 5.6 | 5.10.265 | 6f13f4d52d06 |
| 5.6 | 5.15.216 | f9d6cabff1fc |
| 5.6 | 6.1.183 | 16bfa7be2d76 |
| 5.6 | 6.6.151 | 661ff9c0cfbe |
| 5.6 | 6.12.103 | c710e9bf38e4 |
| 5.6 | 6.18.44 | 4ae701848e4b |
| 5.6 | 7.1.8 | 77dbb248a5cc |
| 5.6 | 7.2 | f30415929be8 |
| 5.4.24 | 0 | 0 |
| 5.5.8 | 0 | 0 |
Debian advisories
| Advisory | Date | Shipped to | Debian |
|---|---|---|---|
| DLA-4788-1 | 2026-09-19 | bookworm 6.12.107-1~deb12u1 | tracker |
| DLA-4777-1 | 2026-09-08 | bookworm 6.1.187-1 | tracker |
| DSA-6466-1 | 2026-08-25 | trixie 6.12.105-1 | tracker |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bug is reached via the netfilter xt_SET packet path (set_target_* -> ip_set_add -> kadt -> mtype_add) during skb processing in iptables hooks; kernel CNA guidance treats netfilter/ipset as Local even when triggering packets arrive from the network.
- AC:LAttack complexity, low
- An attacker can drive both sides of the resize race by filling a comment-enabled hash set and concurrently sending packets that hit SET --add-set --exist while mtype_resize() copies entries, making the shared-comment UAF window repeatable rather than dependent on uncontrollable timing.
- PR:NPrivileges required, none
- Exploitation requires only sending traffic that matches an already-installed SET --exist rule on a comment-enabled ipset during resize; no local account or CAP_NET_ADMIN is needed, though unprivileged user namespaces can also obtain CAP_NET_ADMIN to configure the full attack chain.
- UI:NUser interaction, none
- Triggering is fully automatic through netfilter packet handling once the vulnerable ipset/iptables configuration exists; the attacker does not need the victim to click, mount, or perform any deliberate action beyond ordinary packet delivery.
- S:UScope, unchanged
- The flaw corrupts kernel heap memory and can yield host privilege escalation, but it does not cross a distinct security authority such as a VM/host, container/host, or IOMMU boundary; impact remains within the same kernel security domain.
- C:HConfidentiality impact, high
- Packet-side mtype_add() frees a shared ip_set_comment_rcu during resize, leaving duplicate entries with dangling pointers; backlog replay calls ip_set_init_comment() and strlen() on freed kmalloc memory, a classic UAF that can disclose arbitrary kernel data with heap grooming.
- I:HIntegrity impact, high
- The UAF over RCU-freed comment objects lets an attacker reclaim and control freed slab memory, providing a standard path to arbitrary kernel writes, metadata corruption, and control-flow hijack rather than a bounded or crash-only integrity effect.
- A:HAvailability impact, high
- Stale comment pointer dereference during resize backlog replay can immediately kernel-oops/panic the host, and the underlying UAF heap corruption can crash or hang the system even when full exploitation is not attempted.