CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: clear suppressed fib6 rule result
fib6rulesuppress() drops a suppressed route with ip6rtputflags(), but leaves res->rt6 pointing at the released rt6info.
If no later rule supplies a replacement, fib6rulelookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6lookup(), and the next put hits rcurefputslowpath() from dstrelease().
Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.
Affected Software
Event History
Frequently Asked Questions
What configuration is required to trigger this issue?
The issue requires an IPv6 policy-routing rule that suppresses a route. It manifests when that suppressed route is released and no later rule provides a replacement route.
What is the observable impact of an affected lookup?
A suppressed lookup can return a stale released route to rt6_lookup() rather than falling through to the null destination. A subsequent release of that destination can reach rcuref_put_slowpath() through dst_release().
How can this be mitigated before applying the fix?
Avoid IPv6 FIB rule configurations that suppress routes, particularly where no subsequent rule supplies a replacement. This prevents the suppressed-route path described in the issue.