CVE-2026-74562
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk2th percentile - higher than 2% of all known CVEs
Summary
In the Linux kernel's nexthop module, there is a race condition during nexthop replacement. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk the f6i_list without holding the nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE operations mutate that list under the same lock. This leads to a use-after-free condition that could be exploited for code execution or system crash.
Risk Assessment
The vulnerability could allow a local attacker to escalate privileges or cause a denial of service (DoS) by exploiting the race in IPv6 routing operations. However, it requires access to the rtnetlink interface, which is typically available to privileged users.
Recommendation
It is recommended to immediately update the Linux kernel to a version containing the fix that adds nh->lock protection during f6i_list walks. Also, monitor access to the rtnetlink interface and restrict it to trusted processes.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info: BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799) Read of size 4 at addr ffff888014607e64 by task exploit/143 rt6_fill_node.isra.0 (net/ipv6/route.c:5799) fib6_rt_update (net/ipv6/route.c:6412) __nexthop_replace_notify (net/ipv4/nexthop.c:2542) rtm_new_nexthop (net/ipv4/nexthop.c:2554) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142 fib6_check_nh_list (net/ipv4/nexthop.c:1605) rtm_new_nexthop (net/ipv4/nexthop.c:2575) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) Both walks only read the entries and take no tb6_lock, so protect them with nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC under the lock.