CVE-2026-74492 is a kernel use-after-free in ipset's resize path, stemming from a shallow-copy design assumption that predates the xt_SET packet-side interface. During mtype_resize(), comment pointers are memcpy'd to new table entries rather than duplicating the underlying comment strings—this optimization worked when resize only raced against userspace backlog operations, but xt_SET introduced concurrent packet-side adds that operate under different semantic expectations.
The critical exposure: when packet-side adds use the --exist flag to update entries during resize, the code path calls ip_set_init_comment() on entries that appear to need initialization. This frees comment storage that the replacement table's entries are still pointing to, creating the UAF. The race window exists between the memcpy and the table swap—the window where both the old and new tables reference the same comment pointers.
The patch fixes this by gating ip_set_init_comment() behind an ext->target check, effectively establishing a two-tier comment reliability contract: userspace adds retain full comment semantics, while packet-side adds during resize now silently skip comment updates. This is the correct fix but creates downstream implications you should evaluate.
What you should check: First, verify your kernel version includes the fix (check your distribution's kernel changelog for the ipset resize path patch). Second, audit any automation, SIEM pipelines, or forensic tooling that relies on ipset comment metadata for correlation—if your detection rules use comment fields for rule provenance or policy tracking, you need to understand that resize events may now produce stale or absent comments for packet-side traffic, and your tooling should handle this gracefully rather than flagging it as anomalous. Third, examine your ipset usage patterns: heavy --exist usage with comments in high-throughput environments (especially with frequent resize operations from large sets) is where the race condition is most likely to manifest. Finally, consider whether your deployment's threat model includes a local attacker who could trigger repeated resize operations to amplify the race window—this is the vector that would convert the CVSS 8.4 into practical exploitation.