Linux Kernel CVE-2026-74347

Exploitation requires a local interactive session or code execution on the target system with low-privilege access (CVSS PR:L). The critical limiting condition is that custom conntrack timeout policies must be actively configured on the system via the nfnetlink_cttimeout interface - systems using only the default conntrack timeout behavior are not exposed to this specific flaw. Interacting with the nfnetlink subsystem to configure timeout policies typically requires CAP_NET_ADMIN, which is not available to unprivileged users in standard Linux deployments but IS available within containers with elevated network capabilities or to users granted it via sudo/polkit rules. The race condition itself (policy deletion vs. new conntrack entry attachment) is inherently timing-dependent. Factors limiting exploitation: requires local access (not remotely triggerable), requires CAP_NET_ADMIN or equivalent to configure timeout policies, and requires the nf_ct_timeout feature to be in active use rather than default configuration.

The official CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity. However, several real-world moderating factors exist. First, the EPSS of 0.15% at the 5th percentile and absence from CISA KEV indicate no known active exploitation or public weaponized tooling at time of analysis. Second, while CVSS rates AC:L, exploiting a kernel refcount race condition in practice typically requires precise timing and deep kernel internals knowledge - real-world exploitation complexity is likely higher than AC:L implies; this is a case where CVSS overstates accessibility. Third, the attack surface is narrowed to systems that have custom conntrack timeout policies actively configured via nfnetlink_cttimeout - default kernel deployments without this configuration are not exposed to the specific race. That said, the ubiquity of the Linux kernel, the broad version range (3.4 onward), and the full-kernel-compromise potential if exploited mean this should be treated as a genuine patching priority, not a theoretical concern. No conflicting data between sources was identified, but the lack of a formal CWE assignment and absence of a dedicated vendor security advisory (only git commits and NVD) reduce confidence in version scope.

A local attacker with a low-privilege shell on a system using custom netfilter conntrack timeout policies sends crafted nfnetlink messages to race the deletion of an nf_ct_timeout object against the creation of new conntrack entries that attach to it. When the race is won, the timeout object is freed by the control-plane path while a conntrack entry or nfqueue-queued packet still holds a data-plane reference, triggering a use-after-free in kernel memory. The attacker then leverages kernel heap spraying or other post-exploitation primitives to escalate privileges to root or crash the system. No public proof-of-concept code has been identified in the provided data.