CVE-2026-74562: nexthop: take nh->lock for f6i_list walks in replace check and notify
In the Linux kernel, the following vulnerability has been resolved:
nexthop: take nh->lock for f6ilist walks in replace check and notify
fib6checknhlist() and nexthopreplacenotify() walk nh->f6ilist during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTMNEWROUTE/RTMDELROUTE run without RTNL and mutate that list under nh->lock (fib6addrt2nodenh(), fib6purgert()), so both walks race a concurrent route delete that unlinks and frees a fib6info:
BUG: KASAN: slab-use-after-free in rt6fillnode.isra.0 (net/ipv6/route.c:5799) Read of size 4 at addr ffff888014607e64 by task exploit/143 rt6fillnode.isra.0 (net/ipv6/route.c:5799) fib6rtupdate (net/ipv6/route.c:6412) nexthopreplacenotify (net/ipv4/nexthop.c:2542) rtmnewnexthop (net/ipv4/nexthop.c:2554) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076)
BUG: KASAN: slab-use-after-free in fib6checknhlist (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142 fib6checknhlist (net/ipv4/nexthop.c:1605) rtmnewnexthop (net/ipv4/nexthop.c:2575) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076)
Both walks only read the entries and take no tb6lock, so protect them with nh->lock; fib6rtupdate() uses gfpany(), which returns GFPATOMIC under the lock.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Protect concurrent fib6_info list walks by taking nh->lock around the f6i_list traversal in replace check and notify: add nh->lock for fib6_check_nh_list (net/ipv4/nexthop.c:1605) and __nexthop_replace_notify (net/ipv4/nexthop.c:2542) / rt6_fill_node.isra.0 (net/ipv6/route.c:5799) so these walks do not race with route delete that unlinks and frees fib6_info during RTM_NEWROUTE/RTM_DELROUTE without RTNL.
Linux kernel (nexthop/routing code) nh->lock usage for fib6_info list walks = Enable locking
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74562?
CVE-2026-74562 has a risk rating of 60, indicating a moderate vulnerability.
How do I fix CVE-2026-74562?
To fix CVE-2026-74562, update the Linux kernel to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-74562?
CVE-2026-74562 is classified as a Use After Free vulnerability in the Linux kernel.
What are the potential impacts of CVE-2026-74562?
CVE-2026-74562 could lead to unexpected behavior or crashes in the kernel during nexthop replacement operations.
Which part of the Linux kernel is affected by CVE-2026-74562?
CVE-2026-74562 affects the handling of nexthops and their associated lists during route modifications.