High 7.8Published Aug 26, 2026

CVE-2026-74748netfilter: ipset: fix refcount race between list:set GC and swap

Updated under an hour ago (Oct 27, 2026, 4:30 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -> ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets. Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap() already does, keeping the refcount tied to the index rather than to a stale set pointer. kernel BUG at net/netfilter/ipset/ip_set_core.c:685! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870) Call Trace: <IRQ> list_set_del (net/netfilter/ipset/ip_set_list_set.c:159) set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181) list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578) call_timer_fn (kernel/time/timer.c:1748) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374) run_timer_softirq (kernel/time/timer.c:2405) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	9076aea76538556224e7d73ab718f8841330818a builds before 97a01de0c6321b7210d30d0a4d60f10f561097c7; from 9076aea76538556224e7d73ab718f8841330818a before c21afc7c216a4d257a4f3f300e0791890bc846b9; from 9076aea76538556224e7d73ab718f8841330818a before b0aab9dd1a348b99d75ff52765719d0cc2050630; from 9076aea76538556224e7d73ab718f8841330818a before b891e7a6bb06e0f6560e5932665ac660acd12225; 9076aea76538556224e7d73ab718f8841330818a builds before 20cb13a523f0a05cb2d0a7d72abae687683712e0; from 9076aea76538556224e7d73ab718f8841330818a before cb20da33839f28f590c99f16bafaa6151451c0e8; 9076aea76538556224e7d73ab718f8841330818a builds before 24ffcb1e1688c55fd2a505f064295cd28eac546d; 9076aea76538556224e7d73ab718f8841330818a builds before 0c88868271653537ed443272dd8e7d13634d214b	CNA record

References

References

https://git.kernel.org/stable/c/97a01de0c6321b7210d30d0a4d60f10f561097c7
https://git.kernel.org/stable/c/c21afc7c216a4d257a4f3f300e0791890bc846b9
https://git.kernel.org/stable/c/b0aab9dd1a348b99d75ff52765719d0cc2050630
https://git.kernel.org/stable/c/b891e7a6bb06e0f6560e5932665ac660acd12225
https://git.kernel.org/stable/c/20cb13a523f0a05cb2d0a7d72abae687683712e0
https://git.kernel.org/stable/c/cb20da33839f28f590c99f16bafaa6151451c0e8
https://git.kernel.org/stable/c/24ffcb1e1688c55fd2a505f064295cd28eac546d
https://git.kernel.org/stable/c/0c88868271653537ed443272dd8e7d13634d214b

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.