CVE-2026-74625

The vulnerability is a memory leak in the Linux kernel’s netfilter bridge module. A conntrack template that a bridge nftables conntrack zone rule attaches to an skb can be overwritten when the packet’s EtherType is neither IPv4 nor IPv6. The kernel then replaces the skb->_nfct reference with the marker IP_CT_UNTRACKED without releasing the existing template reference, leaving the template object reachable and eventually exhausting slab memory. The leak could lead to resource exhaustion and a denial‑of‑service. The flaw is a failure to manage resources properly (CWE‑772).

The flaw is present in all Linux kernel builds that compile the bridge nftables patch set and enable the nf_ct_bridge_pre path. Any host that runs a kernel with the nftables bridge module and configures conntrack zone rules on a bridge that can forward non‑IP frames is affected. Typical victims are server or networking devices that forward ARP, RARP, or vendor‑specific Ethernet frames across a bridge.

The CVSS score of 7.5 indicates a high severity, while the EPSS score of <1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog and no public exploit is known. The likely attack vector is an attacker who can inject non‑IP frames into the bridged interface; this inference comes directly from how the kernel processes the packet buffer. If an attacker succeeds, repeated leaks could exhaust kernel memory and trigger a kernel crash or an OOM kill, resulting in system downtime.