CVE-2026-74288: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

Published Aug 15, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: fibrules: Don't dump dying fibrule in fibrulesdump().

rockerrouterfibevent() calls fibruleget() during RCU dump.

If the fibrule is dying, refcountinc() will complain about it.

Let's call refcountincnotzero() in fibrulesdump().

Affected Software

1 affected component

Linux Kernel

Aug 15, 2026

CVE Published

via MITRE·05:57 AM

Data Sourced

via MITRE·05:57 AM

Description

CVE-2026-74288 has a risk rating of 25, indicating a moderate severity level.

To address CVE-2026-74288, ensure your Linux kernel is updated to the latest version that includes the patch.

CVE-2026-74288 may lead to improper handling of dying fib_rules, potentially causing instability.

CVE-2026-74288 affects multiple versions of the Linux kernel prior to the patch release on August 15, 2026.

CVE-2026-74288 is classified as not directly exploitable remotely but may still pose risks in specific configurations.