{"id":11267,"date":"2026-09-04T18:53:07","date_gmt":"2026-09-04T10:53:07","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74695"},"modified":"2026-09-04T18:53:07","modified_gmt":"2026-09-04T10:53:07","slug":"cve-2026-74695","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74695","title":{"rendered":"CVE-2026-74695 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_flow_ta"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()<\/p>\n<p>Incoming skbs passing through netfilter flowtable offload hooks (or XFRM<br \/>\noffload path) might already carry a ref-counted dst_entry assigned during<br \/>\nearlier RX or routing steps.<\/p>\n<p>Calling skb_dst_set_noref() when skb already holds a ref-counted dst<br \/>\noverwrites skb-&gt;_skb_refdst, leaking the previous dst_entry reference<br \/>\ncount and triggering a DEBUG_NET_WARN_ON_ONCE assertion in<br \/>\nskb_dst_check_unset():<\/p>\n<p>  WARNING: at skb_dst_check_unset include\/linux\/skbuff.h:1170<br \/>\n  WARNING: at skb_dst_set_noref include\/linux\/skbuff.h:1234<br \/>\n  WARNING: at nf_flow_offload_ip_hook+0xf6c\/0x2b60 net\/netfilter\/nf_flow_table_ip.c:864<\/p>\n<p>Drop any existing dst_entry reference with skb_dst_drop(skb) before<br \/>\nsetting the non-referenced flowtable destination.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()<\/p>\n<p>Incoming skbs passing through netfilter flowtable offlo<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11267","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}