CVE-2026-74625

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: bridge: release template ct on non-IP path<br /> <br /> A bridge nftables ct zone set rule can attach a conntrack template to<br /> an skb before nf_ct_bridge_pre() sees it. For non-IPv4 and non-IPv6<br /> EtherTypes, nf_ct_bridge_pre() currently overwrites skb-&gt;_nfct with<br /> IP_CT_UNTRACKED without releasing the existing template reference.<br /> <br /> That makes the per-cpu template, and any temporary templates allocated<br /> for concurrent use, unreachable and leaks memory until the host runs out<br /> of slab.<br /> <br /> Reset the skb conntrack state before marking the frame untracked so the<br /> existing template reference is dropped on the non-IP path.