CVE-2026-74561: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
In the Linux kernel, the following vulnerability has been resolved:
nexthop: avoid unlocked f6ilist walk in nhrtcacheflush
nhrtcacheflush() walks nh->f6ilist during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6info entries (nhrtcacheflush() is inlined into rtmnewnexthop()):
BUG: KASAN: slab-use-after-free in nhrtcacheflush (net/ipv4/nexthop.c:2243) Read of size 8 at addr ffff888012953e18 by task exploit/146 nhrtcacheflush (net/ipv4/nexthop.c:2243) replacenexthop (net/ipv4/nexthop.c:2610) rtmnewnexthop (net/ipv4/nexthop.c:3323) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076)
Unlike the other f6ilist walks, this one bumps each route's sernum via fib6updatesernumuptoroot(), which needs tb6lock; taking nh->lock around it would invert the established tb6lock -> nh->lock order and deadlock. As the only purpose is to invalidate cached dsts, bump the IPv6 sernum for the whole netns with rtgenidbumpipv6() instead, mirroring the rtcacheflush() already done for IPv4 just above.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74561?
CVE-2026-74561 has a risk rating of 37, indicating a significant severity level.
How do I fix CVE-2026-74561?
To fix CVE-2026-74561, you should update to the patched version of the Linux kernel that resolves this vulnerability.
What systems are affected by CVE-2026-74561?
CVE-2026-74561 affects the Linux kernel specifically during the handling of nexthop configurations.
What impact does CVE-2026-74561 have on system security?
CVE-2026-74561 can lead to a potential use-after-free condition, which may allow an attacker to execute arbitrary code.
When was CVE-2026-74561 published?
CVE-2026-74561 was published on August 15, 2026.