CVE-2026-74347

A flaw was found in the Linux kernel's netfilter cttimeout component. This issue arises from the improper management of connection tracking timeout policies. When an iptables ruleset continues to reference a connection tracking timeout policy, new connection tracking entries can repeatedly attach to it, thereby extending its active lifetime beyond what is intended. This prolonged retention of resources can lead to resource exhaustion, potentially resulting in a Denial of Service (DoS) for the system.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation is limited to a local denial of service and requires specialized packet filtering configurations. Custom connection tracking timeout policies are not configured by default in standard Red Hat deployments, and manipulating these rulesets typically requires elevated privileges such as network administration capabilities. Although repeated attachment of network flows can prevent timely release of tracking objects and exhaust system memory, the flaw does not facilitate arbitrary code execution or compromise data confidentiality.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.