UBUNTU-CVE-2026-74561: Use After Free
In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush() walks nh->f6ilist during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6info entries (nhrtcacheflush() is inlined into rtmnewnexthop()): BUG: KASAN: slab-use-after-free in nhrtcacheflush (net/ipv4/nexthop.c:2243) Read of size 8 at addr ffff888012953e18 by task exploit/146 nhrtcacheflush (net/ipv4/nexthop.c:2243) replacenexthop (net/ipv4/nexthop.c:2610) rtmnewnexthop (net/ipv4/nexthop.c:3323) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076) Unlike the other f6ilist walks, this one bumps each route's sernum via fib6updatesernumuptoroot(), which needs tb6lock; taking nh->lock around it would invert the established tb6lock -> nh->lock order and deadlock. As the only purpose is to invalidate cached dsts, bump the IPv6 sernum for the whole netns with rtgenidbumpipv6() instead, mirroring the rtcacheflush() already done for IPv4 just above.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-42.42 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1016.17 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1016.18 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1015.16 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-42.42.1 - Compensating control
Change nh_rt_cache_flush() to invalidate cached IPv6 destinations by calling rt_genid_bump_ipv6() for the whole network namespace, instead of walking nh->f6i_list and bumping each route's serial number.
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems running one of the listed Ubuntu kernel packages are potentially affected when IPv6 route add/delete activity can race with nexthop replacement. Exploitation requires local access with low privileges, as reflected by the AV:L and PR:L vector.
What actions are involved in triggering the race?
The race occurs when a nexthop is replaced through RTNL while IPv6 routes are concurrently added or deleted. Those IPv6 route operations mutate and free entries in the nexthop's f6i_list while the replacement path walks that list without the required lock.
What is the impact if the race is triggered?
The vulnerable path can read a freed fib6_info object, producing a kernel slab use-after-free. The supplied severity vector rates confidentiality, integrity, and availability impact as high, with scope changed.
How can I recognize evidence of this issue on an affected system?
A sanitizer-enabled kernel may report a KASAN slab-use-after-free in nh_rt_cache_flush, with stack frames including replace_nexthop, rtm_new_nexthop, and rtnetlink_rcv_msg. The reported access is a read of size 8 from a freed object.