CVE-2026-74581

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74581", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.918Z", "datePublished": "2026-08-21T16:31:54.683Z", "dateUpdated": "2026-10-16T19:05:58.061Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:07.594Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res->rt6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res->rt6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/fib6_rules.c"], "versions": [{"version": "209d35ee34e25f9668c404350a1c86d914c54ffa", "lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb", "status": "affected", "versionType": "git"}, {"version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383", "lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "9bad152c42b37499162367fe47867411e62fffa3", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7", "status": "affected", "versionType": "git"}, {"version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29", "status": "affected", "versionType": "git"}, {"version": "5.10.84", "lessThan": "5.10.265", "status": "affected", "versionType": "semver"}, {"version": "5.15.7", "lessThan": "5.15.216", "status": "affected", "versionType": "semver"}, {"version": "5.4.164", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/fib6_rules.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.84", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.7", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.164"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"}, {"url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"}, {"url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"}, {"url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"}, {"url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"}, {"url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"}, {"url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"}, {"url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"}], "title": "net: ipv6: clear suppressed fib6 rule result", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74581", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:10.675016Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:05:58.061Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74581", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:01:10.675016Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:01:11.542Z"}}], "cna": {"title": "net: ipv6: clear suppressed fib6 rule result", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.8, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res->rt6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "209d35ee34e25f9668c404350a1c86d914c54ffa", "lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb", "versionType": "git"}, {"status": "affected", "version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383", "lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f", "versionType": "git"}, {"status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc", "versionType": "git"}, {"status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa", "versionType": "git"}, {"status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "9bad152c42b37499162367fe47867411e62fffa3", "versionType": "git"}, {"status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb", "versionType": "git"}, {"status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937", "versionType": "git"}, {"status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7", "versionType": "git"}, {"status": "affected", "version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29", "versionType": "git"}, {"status": "affected", "version": "5.10.84", "lessThan": "5.10.265", "versionType": "semver"}, {"status": "affected", "version": "5.15.7", "lessThan": "5.15.216", "versionType": "semver"}, {"status": "affected", "version": "5.4.164", "lessThan": "5.5", "versionType": "semver"}], "programFiles": ["net/ipv6/fib6_rules.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"status": "unaffected", "version": "0", "lessThan": "5.16", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.151", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.103", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.44", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.8", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/ipv6/fib6_rules.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"}, {"url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"}, {"url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"}, {"url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"}, {"url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"}, {"url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"}, {"url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"}, {"url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res->rt6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res->rt6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "5.10.84"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "5.15.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.151", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.103", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.44", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.8", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "5.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.164"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:07.594Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74581", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:05:58.061Z", "dateReserved": "2026-08-15T05:44:03.918Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-21T16:31:54.683Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/fib6_rules.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb", "status": "affected", "version": "209d35ee34e25f9668c404350a1c86d914c54ffa", "versionType": "git"}, {"lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f", "status": "affected", "version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383", "versionType": "git"}, {"lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "9bad152c42b37499162367fe47867411e62fffa3", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"status": "affected", "version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29", "versionType": "git"}, {"lessThan": "5.10.265", "status": "affected", "version": "5.10.84", "versionType": "semver"}, {"lessThan": "5.15.216", "status": "affected", "version": "5.15.7", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.164", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/fib6_rules.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res->rt6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res->rt6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nred: ipv6: limpiar resultado de regla fib6 suprimida\n\nfib6_rule_suppress() descarta una ruta suprimida con ip6_rt_put_flags(), pero deja res -> rt6 apuntando a la rt6_info liberada.\n\nSi ninguna regla posterior proporciona un reemplazo, fib6_rule_lookup() todav\u00eda ve res.rt6 y devuelve ese dst obsoleto a su llamador. Una regla de supresi\u00f3n puede, por lo tanto, filtrar una ruta liberada de vuelta a rt6_lookup(), y el siguiente put alcanza rcuref_put_slowpath() desde dst_release().\n\nLimpiar res -> rt6 al suprimir la ruta para que las b\u00fasquedas suprimidas pasen al dst nulo en lugar de reutilizar el liberado."}], "id": "CVE-2026-74581", "lastModified": "2026-10-16T20:17:39.940", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74581", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:01:10.675016Z", "version": "2.0.3"}}]}, "published": "2026-08-21T17:16:44.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer", "id": "2520980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520980"}, "csaw": true, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6_rule_suppress(), when a route is suppressed and released via ip6_rt_put_flags(), the res->rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6_rule_lookup() returns the stale (freed) rt6_info to its caller. The subsequent dst_release() then operates on freed memory, hitting rcuref_put_slowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the `ipv6` kernel module from loading. Create a file named `/etc/modprobe.d/disable-ipv6.conf` with the following content:\n```\ninstall ipv6 /bin/true\nblacklist ipv6\n```\nAfter creating the file, regenerate the initramfs and reboot the system for the change to take effect. Applications or services that rely on the IPv6 protocol cannot use this mitigation and should prioritize applying the fix."}, "name": "CVE-2026-74581", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74581\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74581\nhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[209d35ee34e25f9668c404350a1c86d914c54ffa,90c57310e266eb94e4a80d6b15a9ca131d2e82cb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383,5d29b286c9de0b309e94b9ed083aa1a2f429434f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdef485217d30382f3bf6448c54b4401648fe3f1,354db6243eca59e9d187ffbf8b7955b044ce84dc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdef485217d30382f3bf6448c54b4401648fe3f1,6d98c70fe0ba8c7708bfd5b2a5174d2086775daa)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdef485217d30382f3bf6448c54b4401648fe3f1,9bad152c42b37499162367fe47867411e62fffa3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdef485217d30382f3bf6448c54b4401648fe3f1,dc3ab04220667f254f4348572b2a0b3febff89fb)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdef485217d30382f3bf6448c54b4401648fe3f1,a341c091ca0bfae377747b1b59a3bd8ebe18a937)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cdef485217d30382f3bf6448c54b4401648fe3f1,6aea62e433fe1b586202a5fee8b5807ce635e1d7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.10.84,5.10.265)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.15.7,5.15.216)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[5.4.164,5.5)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.16"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.16)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.265,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.216,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.183,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.151,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.103,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.44,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1.8,7.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-21T17:45:03.931069+00:00", "updated": "2026-08-25T07:00:08.065911+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}