CVE-2026-74748netfilter: ipset: fix refcount race between list:set GC and swap
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -> ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets. Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap() already does, keeping the refcount tied to the index rather than to a stale set pointer. kernel BUG at net/netfilter/ipset/ip_set_core.c:685! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870) Call Trace: <IRQ> list_set_del (net/netfilter/ipset/ip_set_list_set.c:159) set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181) list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578) call_timer_fn (kernel/time/timer.c:1748) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374) run_timer_softirq (kernel/time/timer.c:2405) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 9076aea76538556224e7d73ab718f8841330818a builds before 97a01de0c6321b7210d30d0a4d60f10f561097c7; from 9076aea76538556224e7d73ab718f8841330818a before c21afc7c216a4d257a4f3f300e0791890bc846b9; from 9076aea76538556224e7d73ab718f8841330818a before b0aab9dd1a348b99d75ff52765719d0cc2050630; from 9076aea76538556224e7d73ab718f8841330818a before b891e7a6bb06e0f6560e5932665ac660acd12225; 9076aea76538556224e7d73ab718f8841330818a builds before 20cb13a523f0a05cb2d0a7d72abae687683712e0; from 9076aea76538556224e7d73ab718f8841330818a before cb20da33839f28f590c99f16bafaa6151451c0e8; 9076aea76538556224e7d73ab718f8841330818a builds before 24ffcb1e1688c55fd2a505f064295cd28eac546d; 9076aea76538556224e7d73ab718f8841330818a builds before 0c88868271653537ed443272dd8e7d13634d214b | CNA record |
References
- https://git.kernel.org/stable/c/97a01de0c6321b7210d30d0a4d60f10f561097c7
- https://git.kernel.org/stable/c/c21afc7c216a4d257a4f3f300e0791890bc846b9
- https://git.kernel.org/stable/c/b0aab9dd1a348b99d75ff52765719d0cc2050630
- https://git.kernel.org/stable/c/b891e7a6bb06e0f6560e5932665ac660acd12225
- https://git.kernel.org/stable/c/20cb13a523f0a05cb2d0a7d72abae687683712e0
- https://git.kernel.org/stable/c/cb20da33839f28f590c99f16bafaa6151451c0e8
- https://git.kernel.org/stable/c/24ffcb1e1688c55fd2a505f064295cd28eac546d
- https://git.kernel.org/stable/c/0c88868271653537ed443272dd8e7d13634d214b
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.