UBUNTU-CVE-2026-74562: Use After Free

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6ilist walks in replace check and notify fib6checknhlist() and nexthopreplacenotify() walk nh->f6ilist during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTMNEWROUTE/RTMDELROUTE run without RTNL and mutate that list under nh->lock (fib6addrt2nodenh(), fib6purgert()), so both walks race a concurrent route delete that unlinks and frees a fib6info: BUG: KASAN: slab-use-after-free in rt6fillnode.isra.0 (net/ipv6/route.c:5799) Read of size 4 at addr ffff888014607e64 by task exploit/143 rt6fillnode.isra.0 (net/ipv6/route.c:5799) fib6rtupdate (net/ipv6/route.c:6412) nexthopreplacenotify (net/ipv4/nexthop.c:2542) rtmnewnexthop (net/ipv4/nexthop.c:2554) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076) BUG: KASAN: slab-use-after-free in fib6checknhlist (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142 fib6checknhlist (net/ipv4/nexthop.c:1605) rtmnewnexthop (net/ipv4/nexthop.c:2575) rtnetlinkrcvmsg (net/core/rtnetlink.c:7076) Both walks only read the entries and take no tb6lock, so protect them with nh->lock; fib6rtupdate() uses gfpany(), which returns GFPATOMIC under the lock.