CVE-2026-74562

Received Received - Intake

Use-After-Free in Linux Kernel IPv6 Routing

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info: BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799) Read of size 4 at addr ffff888014607e64 by task exploit/143 rt6_fill_node.isra.0 (net/ipv6/route.c:5799) fib6_rt_update (net/ipv6/route.c:6412) __nexthop_replace_notify (net/ipv4/nexthop.c:2542) rtm_new_nexthop (net/ipv4/nexthop.c:2554) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142 fib6_check_nh_list (net/ipv4/nexthop.c:1605) rtm_new_nexthop (net/ipv4/nexthop.c:2575) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) Both walks only read the entries and take no tb6_lock, so protect them with nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC under the lock.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-74562

EUVD

EUVD-2026-59627

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where two functions, fib6_check_nh_list() and __nexthop_replace_notify(), access a shared list without proper locking. This can lead to a use-after-free condition when concurrent operations modify the list while it is being read.

Detection Guidance

This vulnerability involves a race condition in the Linux kernel's IPv6 routing code. Detection requires checking kernel logs for slab-use-after-free errors related to rt6_fill_node or fib6_check_nh_list. Monitor system logs for KASAN reports or kernel oops messages indicating memory corruption in IPv6 route handling.

Impact Analysis

This vulnerability could allow an attacker to cause a system crash or execute arbitrary code with kernel privileges by exploiting the race condition during nexthop replacement in IPv6 routing.

Compliance Impact

This vulnerability is a kernel-level issue in Linux affecting IPv6 routing. It does not directly relate to data protection standards like GDPR or HIPAA, which focus on data privacy and security controls. The impact is limited to system stability and potential denial-of-service due to memory corruption in kernel networking code.

Mitigation Strategies

Apply the latest kernel security patches from your Linux distribution. If patches are unavailable, consider disabling IPv6 routing features temporarily or restricting RTNETLINK operations. Monitor kernel logs for signs of exploitation and isolate affected systems if anomalies are detected.

Hi! I’m here to help you understand CVE-2026-74562. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70