CVE-2026-74656
Received Received - Intake

Use-After-Free in Linux Kernel IPv4 fib_nhc_update_mtu

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib_nhc_update_mtu() fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereference_protected() with a constant true condition without holding fnhe_lock. The following interleaving can therefore occur: CPU 0 CPU 1 fib_nhc_update_mtu() update_or_create_fnhe() load fnhe spin_lock_bh(&fnhe_lock) fnhe_remove_oldest() unlink fnhe kfree_rcu(fnhe, rcu) <quiescent state> access fnhe after grace period KASAN reported: BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410 Read of size 8 at addr ffff888107d49000 by task poc/90 Call Trace: fib_nhc_update_mtu+0x3df/0x410 fib_sync_mtu+0x7a/0xd0 fib_netdev_event+0x229/0x3f0 netif_set_mtu_ext+0x33a/0x570 dev_set_mtu+0x88/0x120 The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a pair and other writers serialize them with fnhe_lock. RCU alone prevents reclamation, but would still allow concurrent writers to leave a mixed pair. Walk the table under RCU and acquire fnhe_lock only while updating each exception. RCU keeps the current entry alive while the short critical section serializes its paired PMTU fields. This avoids holding the global lock while scanning all 2048 buckets for every nexthop.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74656
EUVD
EUVD-2026-64593

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's IPv4 networking code. It occurs in the fib_nhc_update_mtu() function which handles MTU updates for nexthop exceptions. The issue arises because the function accesses nexthop exception entries without proper synchronization, allowing another CPU to free the memory while it's still in use. This leads to a memory corruption bug that can crash the system or potentially allow code execution.

Detection Guidance

This vulnerability is specific to the Linux kernel and may not have direct detection commands. However, you can check for kernel logs indicating slab-use-after-free errors or KASAN reports related to fib_nhc_update_mtu. Monitor system logs for crashes or memory corruption issues in networking components.

Impact Analysis

This vulnerability could cause system crashes or instability when network MTU changes occur. An attacker on the local network might exploit this to trigger kernel crashes, leading to denial-of-service conditions. Systems running vulnerable Linux kernel versions could experience unexpected reboots or require manual intervention to recover.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. If immediate patching is not possible, consider isolating or restricting network operations that trigger fib_nhc_update_mtu until the patch is applied. Monitor for unusual system behavior or crashes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74656. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart