https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 08:24:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-74625 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: bridge: release template ct on non-IP path</p> <p>A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb-&gt;_nfct with IP_CT_UNTRACKED without releasing the existing template reference.</p> <p>That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.</p> <p>Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>netfilter: bridge: release template ct on non-IP path</p> <p>A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6 EtherTypes, nf_ct_bridge_pre() currently overwrites skb-&gt;_nfct with IP_CT_UNTRACKED without releasing the existing template reference.</p> <p>That makes the per-cpu template, and any temporary templates allocated for concurrent use, unreachable and leaks memory until the host runs out of slab.</p> <p>Reset the skb conntrack state before marking the frame untracked so the existing template reference is dropped on the non-IP path.</p> https://vulnerability.circl.lu/vuln/cve-2026-74625