CVE-2026-74561

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74561", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.916Z", "datePublished": "2026-08-15T12:28:04.525Z", "dateUpdated": "2026-10-15T10:09:15.073Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-15T10:09:15.073Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop\nreplace without holding nh->lock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh->lock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n Read of size 8 at addr ffff888012953e18 by task exploit/146\n nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n replace_nexthop (net/ipv4/nexthop.c:2610)\n rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route's sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock\naround it would invert the established tb6_lock -> nh->lock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The slab use-after-free is reached only via local RTNETLINK on AF_NETLINK sockets: RTM_NEWNEXTHOP with NLM_F_REPLACE drives replace_nexthop()->nh_rt_cache_flush(), racing concurrent RTM_NEWROUTE/RTM_DELROUTE IPv6 route changes; it is not triggered by remote packet processing.\nAC:L - The race is attacker-controlled: one thread replaces a nexthop under rtnl_net_lock while another concurrently adds/deletes IPv6 routes via unlocked inet6_rtm_newroute/inet6_rtm_delroute handlers; Microsoft reproduced reliable KASAN slab-use-after-free with this pattern.\nPR:L - rtnetlink_rcv_msg() requires CAP_NET_ADMIN via netlink_net_capable() for all non-GET handlers; unprivileged local users obtain this inside a user/network namespace (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through coordinated local netlink nexthop replace and IPv6 route add/delete commands from attacker-controlled processes.\nS:C - A successful UAF from CAP_NET_ADMIN inside an unprivileged user/network namespace corrupts host kernel slab memory and can escape the namespace/container sandbox to compromise the host system, crossing the container-to-host security boundary.\nC:H - The unlocked nh->f6i_list walk dereferences freed fib6_info objects (KASAN read of size 8 at nh_rt_cache_flush), enabling arbitrary kernel memory disclosure via slab heap reuse of attacker-groomed objects.\nI:H - Beyond the UAF read, fib6_update_sernum_upto_root() writes fn_sernum through stale fib6_info/fib6_table pointers; slab UAF on fib6_info provides memory corruption primitives for arbitrary kernel writes and local privilege escalation.\nA:H - The confirmed KASAN slab-use-after-free in nh_rt_cache_flush during nexthop replace causes kernel oops/panic; UAF list walks are inherently crash-prone and can be triggered repeatedly for denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/nexthop.c"], "versions": [{"version": "081efd18326e353c6fbfdeff903a83edde953f72", "lessThan": "f97fae992155b11da516a509c855ff9d0868b107", "status": "affected", "versionType": "git"}, {"version": "081efd18326e353c6fbfdeff903a83edde953f72", "lessThan": "44f53e4331a30fabc38a411fae7524341b618db3", "status": "affected", "versionType": "git"}, {"version": "081efd18326e353c6fbfdeff903a83edde953f72", "lessThan": "4787a6d2629b4e8c0b6bacab1f75c1660eca44d9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/nexthop.c"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.57", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.57"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f97fae992155b11da516a509c855ff9d0868b107"}, {"url": "https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3"}, {"url": "https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9"}], "title": "nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/nexthop.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f97fae992155b11da516a509c855ff9d0868b107", "status": "affected", "version": "081efd18326e353c6fbfdeff903a83edde953f72", "versionType": "git"}, {"lessThan": "44f53e4331a30fabc38a411fae7524341b618db3", "status": "affected", "version": "081efd18326e353c6fbfdeff903a83edde953f72", "versionType": "git"}, {"lessThan": "4787a6d2629b4e8c0b6bacab1f75c1660eca44d9", "status": "affected", "version": "081efd18326e353c6fbfdeff903a83edde953f72", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/nexthop.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.57", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop\nreplace without holding nh->lock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh->lock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n Read of size 8 at addr ffff888012953e18 by task exploit/146\n nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n replace_nexthop (net/ipv4/nexthop.c:2610)\n rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route's sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock\naround it would invert the established tb6_lock -> nh->lock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above."}], "id": "CVE-2026-74561", "lastModified": "2026-10-15T11:17:47.580", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.0, "impactScore": 6.0, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T13:18:01.590", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f97fae992155b11da516a509c855ff9d0868b107"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush", "id": "2517076", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517076"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel, specifically within its nexthop component responsible for network routing. A timing issue, known as a race condition, allows the system to access memory after it has been freed. This occurs when the kernel attempts to flush its routing cache while other operations are simultaneously modifying IPv6 routes. An attacker could potentially exploit this vulnerability to cause a system crash, leading to a denial of service, or in some cases, execute unauthorized code."], "name": "CVE-2026-74561", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74561\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74561\nhttps://lore.kernel.org/linux-cve-announce/2026081552-CVE-2026-74561-23aa@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[081efd18326e353c6fbfdeff903a83edde953f72,44f53e4331a30fabc38a411fae7524341b618db3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[081efd18326e353c6fbfdeff903a83edde953f72,4787a6d2629b4e8c0b6bacab1f75c1660eca44d9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.8,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc6,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T15:45:06.743835+00:00", "updated": "2026-08-18T06:00:04.161697+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}