Use-after-free in Linux kernel - CVE-2026-74492

Vulnerability details

The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to a use-after-free in mtype_add() when processing packet-side add operations during ipset table resizing. A remote user can trigger xt_SET --add-set ... --exist updates to cause a denial of service.

The issue occurs when a replacement-table entry and an old-table entry temporarily share the same comment pointer during resize and backlog replay, leading to a stale pointer dereference in strlen().

Affected software

How to mitigate CVE-2026-74492

External References

• https://git.kernel.org/stable/c/4ae701848e4ba9e9713375fb7d82218cbd309da2
• https://git.kernel.org/stable/c/661ff9c0cfbe07f8eed920dde9f7781491738207
• https://git.kernel.org/stable/c/77dbb248a5cc7a5270cd37bbb0b635bf059a872a
• https://git.kernel.org/stable/c/c710e9bf38e4e71a8db85d26a0f70c0674664207
• https://git.kernel.org/stable/c/f30415929be8aeb002d557c8d3f7ab2d2188003a

Related Security Bulletins

• Use-after-free in Linux kernel netfilter ipset
• Debian update for linux