CVE-2026-64572
Received Received - Intake

Use-After-Free in Linux Kernel IPv4 FIB

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free(). fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free: BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56 Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough. Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-05
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-64572
EUVD
EUVD-2026-53266

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's IPv4 forwarding implementation. When inserting a new route fails, the kernel frees memory holding route data while another process might still be accessing it. This happens because the route is published before notifiers check it, and failure triggers immediate freeing instead of deferred cleanup.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv4 forwarding implementation and requires kernel debugging tools to detect. Enable KASAN (Kernel Address Sanitizer) in your kernel configuration and look for slab-use-after-free errors in the kernel logs related to fib_table_lookup. Check for crashes or memory corruption in network-related processes.

Impact Analysis

An attacker with CAP_NET_ADMIN privileges could exploit this to crash the system or potentially execute arbitrary code. The vulnerability requires a specific setup with a registered fib notifier that rejects routes, such as a netdevsim device with exhausted IPv4 FIB resources.

Compliance Impact

This vulnerability is a use-after-free flaw in the Linux kernel's IPv4 routing subsystem that could lead to memory corruption or crashes. It does not directly impact compliance with standards like GDPR or HIPAA, as those focus on data protection and privacy rather than kernel memory management issues.

Mitigation Strategies

Apply the latest kernel patches from your Linux distribution to fix the fib_alias handling issue. If patching is not immediately possible, restrict CAP_NET_ADMIN capabilities to untrusted users and avoid using netdevsim devices with IPv4 FIB resource exhaustion. Monitor kernel logs for fib_table_lookup errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64572. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart