CVE-2026-74748

Red Hat rates this flaw as having Moderate security impact. It is a race condition in the Linux kernel's netfilter ipset component, affecting the kernel and kernel-rt packages in Red Hat Enterprise Linux 7 Extended Lifecycle Support, 8, 9, and 10, and the kernel and kernel-ivos-qualcomm components in Red Hat In-Vehicle OS 2.0 and 2.1. The ipset list:set garbage collection runs from timer softirq, which the nfnl mutex does not serialize against set swap operations. __ip_set_put_byindex() resolves a set index to a set pointer under RCU and only then acquires ip_set_ref_lock to decrement the reference count, while ip_set_swap() swaps the ip_set_list slots and both sets' reference counters under that same lock. A swap can therefore interleave between the dereference and the lock acquisition, leaving the garbage collection path to decrement a set whose reference has already moved to the other index and hit BUG_ON(set->ref == 0). A local attacker or privileged user able to run concurrent ipset operations, such as swapping sets while list:set members expire, can trigger this race, causing a kernel panic and system crash, i.e. a denial of service. There is no impact to confidentiality or integrity.

The upstream CVE record assigns this flaw a CVSS 3.1 score of 7.8 (Important) with high confidentiality, integrity, and availability impacts. Red Hat instead assigns 5.5 (Moderate, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H), because the verified technical evidence shows only a loss of availability through a kernel panic and exploitation requires local privileged access to perform the necessary ipset operations.

For the affected Red Hat Enterprise Linux and Red Hat In-Vehicle OS versions, the fix is deferred to a future update given the Moderate security impact; the residual risk until the fix is delivered is that a local privileged user could trigger a kernel panic and crash an affected system. Red Hat Enterprise Linux 6 is out of support scope for this flaw.