netfilter: ipset: fix refcount race between list:set GC and swap

MITRE NVD CVE.ORG JSON API

Summary

CVECVE-2026-74748
StatePUBLISHED
AssignerLinux
Source PriorityCVE Program / NVD first with legacy fallback
Published2026-08-26 15:16:53 UTC
Updated2026-08-27 06:17:25 UTC
DescriptionIn the Linux kernel, the following vulnerability has been resolved: netfilter: ipset: fix refcount race between list:set GC and swap __ip_set_put_byindex() resolved the index to a set pointer under RCU, then took ip_set_ref_lock in __ip_set_put() to decrement set->ref. ip_set_swap() holds that same lock while swapping both the ip_set_list slots and the two sets' ref counters, so it can interleave between the dereference and the lock acquisition, leaving the caller to decrement a set whose reference already moved to the other index and hit BUG_ON(set->ref == 0). list_set_gc() reaches this from timer softirq, which the nfnl mutex does not serialize against swap: an expiring list:set member calls list_set_del() -> ip_set_put_byindex() while IPSET_CMD_SWAP runs on the referenced sets. Resolve the index and decrement under ip_set_ref_lock, as ip_set_swap() already does, keeping the refcount tied to the index rather than to a stale set pointer. kernel BUG at net/netfilter/ipset/ip_set_core.c:685! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ip_set_put_byindex (net/netfilter/ipset/ip_set_core.c:870) Call Trace: <IRQ> list_set_del (net/netfilter/ipset/ip_set_list_set.c:159) set_cleanup_entries (net/netfilter/ipset/ip_set_list_set.c:181) list_set_gc (net/netfilter/ipset/ip_set_list_set.c:578) call_timer_fn (kernel/time/timer.c:1748) __run_timers (kernel/time/timer.c:1799 kernel/time/timer.c:2374) run_timer_softirq (kernel/time/timer.c:2405) </IRQ> Kernel panic - not syncing: Fatal exception in interrupt

Risk And Classification

Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.001380000 probability, percentile 0.035230000 (date 2026-08-27)

VersionSourceTypeScoreSeverityVector
3.1416baaa9-dc9f-4396-8d5f-8c081fb06d67Secondary7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
3.1CNADECLARED7.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1 Breakdown

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Vendor Declared Affected Products

SourceVendorProductVersionPlatforms
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a 97a01de0c6321b7210d30d0a4d60f10f561097c7 git Not specified
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a c21afc7c216a4d257a4f3f300e0791890bc846b9 git Not specified
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a b0aab9dd1a348b99d75ff52765719d0cc2050630 git Not specified
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a b891e7a6bb06e0f6560e5932665ac660acd12225 git Not specified
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a 20cb13a523f0a05cb2d0a7d72abae687683712e0 git Not specified
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a cb20da33839f28f590c99f16bafaa6151451c0e8 git Not specified
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a 24ffcb1e1688c55fd2a505f064295cd28eac546d git Not specified
CNA Linux Linux affected 9076aea76538556224e7d73ab718f8841330818a 0c88868271653537ed443272dd8e7d13634d214b git Not specified
CNA Linux Linux affected 3.8 Not specified
CNA Linux Linux unaffected 3.8 semver Not specified
CNA Linux Linux unaffected 5.10.266 5.10.* semver Not specified
CNA Linux Linux unaffected 5.15.217 5.15.* semver Not specified
CNA Linux Linux unaffected 6.1.184 6.1.* semver Not specified
CNA Linux Linux unaffected 6.6.153 6.6.* semver Not specified
CNA Linux Linux unaffected 6.12.105 6.12.* semver Not specified
CNA Linux Linux unaffected 6.18.46 6.18.* semver Not specified
CNA Linux Linux unaffected 7.1.10 7.1.* semver Not specified
CNA Linux Linux unaffected 7.2 * original_commit_for_fix Not specified

References

ReferenceSourceLinkTags
git.kernel.org/stable/c/24ffcb1e1688c55fd2a505f064295cd28eac546d 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b0aab9dd1a348b99d75ff52765719d0cc2050630 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/20cb13a523f0a05cb2d0a7d72abae687683712e0 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/c21afc7c216a4d257a4f3f300e0791890bc846b9 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/97a01de0c6321b7210d30d0a4d60f10f561097c7 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/0c88868271653537ed443272dd8e7d13634d214b 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/b891e7a6bb06e0f6560e5932665ac660acd12225 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
git.kernel.org/stable/c/cb20da33839f28f590c99f16bafaa6151451c0e8 416baaa9-dc9f-4396-8d5f-8c081fb06d67 git.kernel.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis

© CVE.report 2026

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

Free CVE JSON API cve.report/api

CVE.report and Source URL Uptime Status status.cve.report