CVE-2026-74695

A flaw was found in the Linux kernel's netfilter flow table. When processing network packets, a reference count leak can occur if a packet already has a destination entry and skb_dst_set_noref() is called. This issue can lead to a kernel warning, potentially causing system instability or a denial of service (DoS) for affected systems.

nf_flow_table can overwrite an existing refcounted skb dst_entry with skb_dst_set_noref without first dropping the old reference. This leaks dst_entry references on packets that enter the flowtable offload or XFRM offload path with an already attached dst, and sustained traffic may exhaust kernel networking resources. For the CVSS the PR:N is used because an attacker does not need a local account when they can send traffic through a configured flowtable path. The issue is network reachable only on systems where nf_flow_table or the relevant offload path is enabled and reachable by attacker controlled traffic. Impact is denial of service through resource exhaustion. There is no clear evidence of memory corruption, information disclosure, or privilege escalation from this patch context.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.