CVE-2026-74581
Received Received - Intake

IPv6 Route Suppression Use-After-Free in Linux Kernel

Publication date: 2026-08-21

Last updated on: 2026-08-21

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-21
Last Modified
2026-08-21
Generated
2026-08-21
AI Q&A
2026-08-21
EPSS Evaluated
N/A
NVD
CVE-2026-74581
EUVD
EUVD-2026-64003

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the IPv6 routing subsystem where a suppressed route is not properly cleared. When a route is suppressed, the system fails to reset a pointer, causing it to still reference a released memory location. This can lead to a use-after-free scenario where the stale route is incorrectly reused, potentially causing system instability or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's IPv6 networking stack and may not have direct detection commands. Monitor kernel logs for crashes or unusual network behavior after IPv6 route suppression events. Check for kernel oops or warnings related to dst_release() or fib6_rule_lookup().

Impact Analysis

This vulnerability could allow an attacker to trigger a use-after-free condition, leading to system crashes, denial-of-service, or potentially privilege escalation. Systems relying on IPv6 networking are most at risk, especially those with complex routing rules.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If immediate patching is not possible, consider disabling IPv6 temporarily or restricting IPv6 traffic until the fix is applied. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74581. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart