EUVD-2026-64382
GHSA-cx4h-xjm7-pqxp
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Flowtable offload is a non-default configuration (AC:H); remote unauthenticated packets trigger the leak (AV:N/PR:N); impact is availability-only via kernel DoS.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
netfilter: nf_flow_table: drop existing skb dst before skb_dst_set_noref()
Incoming skbs passing through netfilter flowtable offload hooks (or XFRM offload path) might already carry a ref-counted dst_entry assigned during earlier RX or routing steps.
Calling skb_dst_set_noref() when skb already holds a ref-counted dst overwrites skb->_skb_refdst, leaking the previous dst_entry reference count and triggering a DEBUG_NET_WARN_ON_ONCE assertion in skb_dst_check_unset():
WARNING: at skb_dst_check_unset include/linux/skbuff.h:1170 WARNING: at skb_dst_set_noref include/linux/skbuff.h:1234 WARNING: at nf_flow_offload_ip_hook+0xf6c/0x2b60 net/netfilter/nf_flow_table_ip.c:864
Drop any existing dst_entry reference with skb_dst_drop(skb) before setting the non-referenced flowtable destination.
AnalysisAI
Reference count leak in the Linux kernel netfilter flowtable offload path allows a remote attacker to cause a denial of service by sending network packets through a system with nf_flow_table offload configured. The flaw occurs in nf_flow_offload_ip_hook() and the XFRM offload path when skb_dst_set_noref() overwrites an existing ref-counted dst_entry without first dropping it, leaking the reference and triggering a DEBUG_NET_WARN_ON_ONCE kernel assertion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation strictly requires that the target Linux system has netfilter flowtable offload actively configured - specifically, nft_flow_offload action rules must be present in nftables and the nf_flow_table kernel module (plus nf_flow_table_ipv4 or nf_flow_table_ipv6) must be loaded. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 7.5 (AV:N/AC:L/PR:N/UI:N) overstates realistic risk by setting AC:L, which implies the vulnerability is trivially triggerable under default conditions. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker sends a sustained stream of network packets to a Linux router or firewall where nftables flow offload rules are configured. The packets enter the nf_flow_offload_ip_hook() processing path carrying a ref-counted dst_entry from an earlier routing step; the hook calls skb_dst_set_noref() without first dropping the existing reference, leaking one dst_entry reference count per packet. … |
| Remediation | Apply one of the three upstream stable-tree patches: https://git.kernel.org/stable/c/8aecf0bbcc72605592134c917c222207d8f63ab0 (for the 6.18.x branch), https://git.kernel.org/stable/c/12afa450a6a6c0cce2c42b7545a9958f62d8a00c, or https://git.kernel.org/stable/c/538e67e8c7889cf5f93951f5309d1bcb41f86036. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit Linux systems to identify those with netfilter nf_flow_table offload enabled by examining kernel configuration and active modules. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today