CVE-2026-74496

Received Received - Intake

Use-After-Free in Linux Kernel fou_create()

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fou: Fix use-after-free in fou_create() fou_create() publishes struct fou through sk_user_data before adding the new FOU port to the per-netns list. If fou_add_to_port_list() fails, the error path frees fou while it is still reachable through sk_user_data. A concurrent receive can then dereference the freed object in fou_from_sock(). This ordering issue was previously noted in the linked discussion. The failure is reachable when local port 0 is requested. Each socket binds to a different ephemeral port, but fou_cfg_cmp() compares the requested port 0 and reports -EALREADY once an entry already exists. Release the tunnel socket before freeing fou so sk_user_data is cleared first, and defer reclamation with kfree_rcu() to protect concurrent RCU readers. This matches the lifetime handling in fou_release().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74496

EUVD

EUVD-2026-59689

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's FOU (Foo Over UDP) module. The issue occurs in fou_create() where a struct fou is published through sk_user_data before being added to a per-netns list. If fou_add_to_port_list() fails, the error path frees the fou object while it remains accessible via sk_user_data. A concurrent receive operation could then dereference this freed memory in fou_from_sock().

Detection Guidance

This vulnerability involves a use-after-free in the Linux kernel's FOU (Foo Over UDP) module. Detection requires checking for kernel logs or crashes related to fou_create() or fou_from_sock(). Look for kernel oops messages or panics involving FOU functionality. Check if FOU ports are bound to port 0, which triggers the issue. Commands like dmesg, journalctl -k, or checking /var/log/kern.log may reveal errors.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service condition or potentially execute arbitrary code with kernel privileges. Successful exploitation requires specific conditions, including requesting local port 0 and a failure in fou_add_to_port_list().

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a use-after-free flaw in the Linux kernel's FOU (Foo Over UDP) subsystem, which could lead to local denial-of-service or privilege escalation but does not involve data breaches or unauthorized access to sensitive information.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves the issue. Disable the FOU module if not in use by unloading the fou kernel module (rmmod fou). If FOU is required, avoid binding to port 0. Monitor kernel logs for signs of exploitation or crashes. Apply vendor patches as soon as they are available.

Hi! I’m here to help you understand CVE-2026-74496. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70