CVE-2026-74625 is a vulnerability in the Linux kernel's netfilter bridge nftables implementation. Specifically, a conntrack template can be attached to an skb before the nf_ct_bridge_pre() function processes it. For non-IPv4 and non-IPv6 Ethernet types, nf_ct_bridge_pre() overwrites skb->_nfct with IP_CT_UNTRACKED without releasing the existing template reference. This results in the per-CPU template and any temporary templates allocated concurrently becoming unreachable, causing a memory leak that persists until the host runs out of slab memory. The vulnerability was resolved by resetting the skb conntrack state before marking the frame as untracked, which properly drops the existing template reference on non-IP paths.

The vulnerability causes a memory leak in the Linux kernel's networking stack when processing certain non-IP Ethernet frames in bridge nftables. This leak can lead to exhaustion of slab memory on the host, potentially degrading system stability or causing denial of service due to resource depletion. There is no indication of direct code execution or privilege escalation from the provided data.

A fix has been implemented in the Linux kernel to address this issue by resetting the skb conntrack state before marking the frame untracked, ensuring the template reference is properly released. Users should apply the official kernel updates that include this fix. Since no specific patch links or affected versions are provided, check the vendor or Linux kernel advisories for the exact fixed versions and apply updates accordingly.