High 7.8Published Aug 15, 2026

CVE-2026-74260netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them

Updated under an hour ago (2026-10-19 07:30 UTC)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to address a possible migration to different CPU leading to imbalanced decrementation of the recursion counters. This is modeled after Florian Westphal's dev_xmit_recursion*() API available since commit 97cdcf37b57e ("net: place xmit recursion in softnet data") according to its current state in the tree.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f37ad91270397a6d053e8623bdb3cf79859691d2 before 53fb46cf933dc4361c1a72491e247841d0b0fc85; from f37ad91270397a6d053e8623bdb3cf79859691d2 before edf234f71fb327792196f813048ab8f5bd3bb712; from f37ad91270397a6d053e8623bdb3cf79859691d2 before 2354e975932dabb06fad239f07a3b68fd1809737	CNA record

References

https://git.kernel.org/stable/c/53fb46cf933dc4361c1a72491e247841d0b0fc85
https://git.kernel.org/stable/c/edf234f71fb327792196f813048ab8f5bd3bb712
https://git.kernel.org/stable/c/2354e975932dabb06fad239f07a3b68fd1809737

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.