CVE-2026-74260 (GCVE-0-2026-74260)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to address a possible migration to different CPU leading to imbalanced decrementation of the recursion counters. This is modeled after Florian Westphal's dev_xmit_recursion*() API available since commit 97cdcf37b57e ("net: place xmit recursion in softnet data") according to its current state in the tree.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f37ad91270397a6d053e8623bdb3cf79859691d2 , < edf234f71fb327792196f813048ab8f5bd3bb712 (git)
Affected: f37ad91270397a6d053e8623bdb3cf79859691d2 , < 2354e975932dabb06fad239f07a3b68fd1809737 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_dup_netdev.h",
            "net/netfilter/nf_dup_netdev.c",
            "net/netfilter/nft_fwd_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "edf234f71fb327792196f813048ab8f5bd3bb712",
              "status": "affected",
              "version": "f37ad91270397a6d053e8623bdb3cf79859691d2",
              "versionType": "git"
            },
            {
              "lessThan": "2354e975932dabb06fad239f07a3b68fd1809737",
              "status": "affected",
              "version": "f37ad91270397a6d053e8623bdb3cf79859691d2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/netfilter/nf_dup_netdev.h",
            "net/netfilter/nf_dup_netdev.c",
            "net/netfilter/nft_fwd_netdev.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them\n\nUpdate nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers.\nThis patch also disables BH when transmitting the skb to address a\npossible migration to different CPU leading to imbalanced decrementation\nof the recursion counters.\n\nThis is modeled after Florian Westphal\u0027s dev_xmit_recursion*() API\navailable since commit 97cdcf37b57e (\"net: place xmit recursion in\nsoftnet data\") according to its current state in the tree."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The flaw is reached through nftables netdev fwd/dup evaluation on NF_NETDEV ingress/egress hooks installed via nfnetlink; kernel CNA guidance treats netfilter/nftables configuration and packet-hook paths as Local even when traffic ultimately arrives from the network.\nAC:L - An attacker with CAP_NET_ADMIN can deterministically install netdev egress/ingress fwd or dup rules that loop (same device or mutual forwarding) and drive packets through them; concurrent traffic also lets the attacker influence CPU migration that desynchronizes the per-CPU recursion counter without uncontrollable races.\nPR:L - Installing netdev nftables fwd/dup rules requires CAP_NET_ADMIN via nfnetlink (netlink_net_capable), but that capability is routinely obtainable in an unprivileged-created user+network namespace (unshare -Urn) and is commonly delegated to containers with NET_ADMIN.\nUI:N - Exploitation needs only the attacker\u0027s own nftables/netlink setup and packet injection; no victim must mount filesystems, open files, click prompts, or perform any deliberate interactive action beyond ordinary traffic delivery.\nS:U - Impact is unbounded kernel-stack recursion and crash/panic within the same kernel security domain; it does not cross a VM, container, IOMMU, or other distinct security-authority boundary such as guest-to-host escape.\nC:H - Bypassing the nf_dup_skb_recursion limit allows unbounded nf_hook_egress/ingress re-entry that corrupts kernel stack frames before the guard page; such stack corruption can disclose adjacent kernel memory and is not a pure NULL-deref crash with no data exposure.\nI:H - Unbounded recursion overflows the kernel task stack and overwrites saved return addresses/control data on the stack, providing a standard path to arbitrary kernel writes and control-flow hijack rather than a bounded or crash-only integrity effect.\nA:H - When the per-CPU recursion counter is desynchronized by CPU migration without local_bh_disable(), fwd/dup netdev rules can recurse without bound through neigh_xmit/dev_queue_xmit and nf_hook_egress, exhausting the kernel stack and causing oops/panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:09.808Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/edf234f71fb327792196f813048ab8f5bd3bb712"
        },
        {
          "url": "https://git.kernel.org/stable/c/2354e975932dabb06fad239f07a3b68fd1809737"
        }
      ],
      "title": "netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74260",
    "datePublished": "2026-08-15T05:57:37.579Z",
    "dateReserved": "2026-08-15T05:44:03.877Z",
    "dateUpdated": "2026-08-17T05:45:09.808Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74260",
      "date": "2026-09-20",
      "epss": "0.00154",
      "percentile": "0.04939"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_dup_netdev.h",
                  "net/netfilter/nf_dup_netdev.c",
                  "net/netfilter/nft_fwd_netdev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "edf234f71fb327792196f813048ab8f5bd3bb712",
                    "status": "affected",
                    "version": "f37ad91270397a6d053e8623bdb3cf79859691d2",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2354e975932dabb06fad239f07a3b68fd1809737",
                    "status": "affected",
                    "version": "f37ad91270397a6d053e8623bdb3cf79859691d2",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/netfilter/nf_dup_netdev.h",
                  "net/netfilter/nf_dup_netdev.c",
                  "net/netfilter/nft_fwd_netdev.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them\n\nUpdate nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers.\nThis patch also disables BH when transmitting the skb to address a\npossible migration to different CPU leading to imbalanced decrementation\nof the recursion counters.\n\nThis is modeled after Florian Westphal\u0027s dev_xmit_recursion*() API\navailable since commit 97cdcf37b57e (\"net: place xmit recursion in\nsoftnet data\") according to its current state in the tree."
          }
        ],
        "id": "CVE-2026-74260",
        "lastModified": "2026-08-17T06:19:19.500",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:25.210",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2354e975932dabb06fad239f07a3b68fd1809737"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/edf234f71fb327792196f813048ab8f5bd3bb712"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-19T19:39:29+00:00",
      "cve": "CVE-2026-74260",
      "id": "CVE-2026-74260",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74260.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.