CVE-2026-74625

A flaw was found in the Linux kernel's netfilter bridge component. This vulnerability allows for a memory leak when the system processes non-IPv4 and non-IPv6 network traffic through a bridge nftables connection tracking rule. The system fails to release an existing connection tracking template reference, leading to a gradual accumulation of unreleased memory. This can ultimately result in a denial of service (DoS) condition as the host runs out of available memory.

A moderate-impact flaw was found in the Linux kernel's netfilter bridge code, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 9 and 10 and the kernel and kernel-ivos-qualcomm packages in Red Hat In-Vehicle OS 2. When an nftables rule that sets a connection tracking zone (a "ct zone set" rule) is configured for bridged traffic, it can attach a conntrack template to a socket buffer (skb) before nf_ct_bridge_pre() processes the frame. For frames with non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() overwrites the skb's conntrack state with IP_CT_UNTRACKED without releasing the existing template reference, making the per-cpu template and any temporary templates allocated for concurrent use unreachable. An attacker with layer 2 (network-adjacent) access to a host with such a rule configured can send non-IP frames to the affected bridge to repeatedly trigger this path, gradually leaking kernel slab memory until the host runs out of memory, resulting in a denial of service. Confidentiality and integrity are not affected. Red Hat Enterprise Linux 6, 7, and 8 are not affected because the vulnerable code is not present in those releases. The upstream CVEORG severity is Important (CVSS 3.1 score 7.5, AV:N/AC:L/PR:N), which differs from Red Hat's Moderate rating (CVSS 3.1 score 5.5, AV:L/AC:L/PR:L) because exploitation requires an administrator-configured nftables bridge connection tracking zone rule and network-adjacent access to send non-IP frames to the bridge, rather than unauthenticated remote network reachability, and the impact is limited to availability. Fixes for the affected Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, and Red Hat In-Vehicle OS 2 streams have been deferred to a future update because the flaw only affects availability and requires the specific bridged nftables ct zone configuration to be present; the residual risk is a gradual kernel memory leak that can eventually exhaust memory and cause denial of service on hosts where that configuration is exposed to non-IP traffic from the local network segment.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

The memory leak requires an nftables "ct zone set" rule on bridged traffic, which attaches a conntrack template to the skb before nf_ct_bridge_pre() processes non-IP frames. Removing or disabling such "ct zone set" rules for traffic forwarded through a software bridge prevents the conntrack template from being attached on this path and avoids the leak, at the cost of the intended connection tracking zone assignment for that traffic. No other mitigation is currently known.