What’s Vulnerable › Vulnerabilities

CVE-2026-74260: netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-15 · updated 2026-10-15

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them Update nft_dup and nft_fwd to use the nf_dev_xmit_recursion() helpers. This patch also disables BH when transmitting the skb to address a possible migration to different CPU leading to imbalanced decrementation of the recursion counters. This is modeled after Florian Westphal's dev_xmit_recursion*() API available since commit 97cdcf37b57e ("net: place xmit recursion in softnet data") according to its current state in the tree.

Affected products

• Linux kernel: 6.16 — fixed in 7.2

How to fix

Upgrade to a fixed version: Linux kernel 7.2. Check the vendor advisory for mitigations.

References

• https://git.kernel.org/stable/c/2354e975932dabb06fad239f07a3b68fd1809737
• https://git.kernel.org/stable/c/53fb46cf933dc4361c1a72491e247841d0b0fc85
• https://git.kernel.org/stable/c/edf234f71fb327792196f813048ab8f5bd3bb712

Get alerted when CVE-2026-74260 or the next vulnerability affects your stack