CVE-2026-74630

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74630", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.921Z", "datePublished": "2026-08-22T15:32:11.596Z", "dateUpdated": "2026-10-16T19:06:03.622Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:54.475Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\n\nin6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\n\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\n\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\n\n refcount_t: addition on 0; use-after-free.\n ip6_mc_source+0xef4/0x17e0\n\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\n\n BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\n Write of size 8 at addr ffff888015b50240 by task poc/1219\n\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The reliable path is local setsockopt(2) on IPv6 MCAST source-filter options (ipv6_setsockopt \u2192 do_ipv6_mcast_group_source \u2192 ip6_mc_source \u2192 in6_dev_get), reproduced as UID 1000; concurrent netdev unregister is also a local rtnetlink syscall, not remote packet delivery.\nAC:L - An attacker in their own user+network namespace controls both sides of the race\u2014hammering MCAST_JOIN/BLOCK/UNBLOCK_SOURCE setsockopt while deleting the bound veth via RTM_DELLINK\u2014so the ip6_ptr clear and final in6_dev_put window is attacker-driven and retryable.\nPR:L - Multicast setsockopt needs no capability, but hitting the unregister teardown that drops the last inet6_dev reference requires CAP_NET_ADMIN for RTM_DELLINK; that is ns_capable() in the netns user_ns and is obtainable by an unprivileged user via unshare -Urn, not init-namespace root.\nUI:N - Exploitation uses only the attacker's own IPv6 sockets, setsockopt calls, and netdev create/delete in their namespace; no victim mount, click, or other cooperation is required.\nS:U - The resurrected inet6_dev UAF corrupts kernel heap state within the host kernel authority (mutex_lock on freed mc_lock); it is standard local kernel memory corruption, not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - Resurrecting a zero-refcount inet6_dev whose RCU free is already queued is a slab use-after-free; KASAN reported UAF on freed inet6_dev memory, and such heap UAFs enable disclosure via controlled reuse of the freed object.\nI:H - After resurrection the caller locks idev->mc_lock and mutates multicast state on freed memory (KASAN write in mutex_lock), giving attacker-influenced heap corruption that can be turned into arbitrary write or control-flow hijack.\nA:H - The PoC triggers refcount_t addition-on-0 warnings, refcount underflow, and KASAN slab-use-after-free in mutex_lock, demonstrating immediate kernel memory corruption that can oops/panic and be repeated by re-running the race."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/addrconf.h"], "versions": [{"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "785d908f8d21c8bc78b6fb2c2932ab662bf6918a", "status": "affected", "versionType": "git"}, {"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8", "status": "affected", "versionType": "git"}, {"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "145812b678de9f3b59780173be3c0d22ed60dd93", "status": "affected", "versionType": "git"}, {"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "cc5bd568f9b7683e60841b6fd02c10d64535bd6e", "status": "affected", "versionType": "git"}, {"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "1c206d461c680c3151daa3c89fc26eaf5bf98a7f", "status": "affected", "versionType": "git"}, {"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "680fbd7942185448eadb990a3d10a53eb946b702", "status": "affected", "versionType": "git"}, {"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "14e812ab41df0cac033479da835ec9a5de633404", "status": "affected", "versionType": "git"}, {"version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "0e243671bc7b8eaf00f83dd2f4367436dc0cff98", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/addrconf.h"], "versions": [{"version": "2.6.19", "status": "affected"}, {"version": "0", "lessThan": "2.6.19", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.152", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.104", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.45", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.9", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.6.152"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.12.104"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "6.18.45"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.1.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.19", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a"}, {"url": "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8"}, {"url": "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93"}, {"url": "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e"}, {"url": "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f"}, {"url": "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702"}, {"url": "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404"}, {"url": "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98"}], "title": "ipv6: prevent in6_dev_get() from resurrecting inet6_dev", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:57.486583Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:06:03.622Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74630", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T19:02:57.486583Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T19:02:58.651Z"}}], "cna": {"title": "ipv6: prevent in6_dev_get() from resurrecting inet6_dev", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The reliable path is local setsockopt(2) on IPv6 MCAST source-filter options (ipv6_setsockopt \u2192 do_ipv6_mcast_group_source \u2192 ip6_mc_source \u2192 in6_dev_get), reproduced as UID 1000; concurrent netdev unregister is also a local rtnetlink syscall, not remote packet delivery.\nAC:L - An attacker in their own user+network namespace controls both sides of the race\u2014hammering MCAST_JOIN/BLOCK/UNBLOCK_SOURCE setsockopt while deleting the bound veth via RTM_DELLINK\u2014so the ip6_ptr clear and final in6_dev_put window is attacker-driven and retryable.\nPR:L - Multicast setsockopt needs no capability, but hitting the unregister teardown that drops the last inet6_dev reference requires CAP_NET_ADMIN for RTM_DELLINK; that is ns_capable() in the netns user_ns and is obtainable by an unprivileged user via unshare -Urn, not init-namespace root.\nUI:N - Exploitation uses only the attacker's own IPv6 sockets, setsockopt calls, and netdev create/delete in their namespace; no victim mount, click, or other cooperation is required.\nS:U - The resurrected inet6_dev UAF corrupts kernel heap state within the host kernel authority (mutex_lock on freed mc_lock); it is standard local kernel memory corruption, not a VM escape, IOMMU bypass, or other cross-boundary impact.\nC:H - Resurrecting a zero-refcount inet6_dev whose RCU free is already queued is a slab use-after-free; KASAN reported UAF on freed inet6_dev memory, and such heap UAFs enable disclosure via controlled reuse of the freed object.\nI:H - After resurrection the caller locks idev->mc_lock and mutates multicast state on freed memory (KASAN write in mutex_lock), giving attacker-influenced heap corruption that can be turned into arbitrary write or control-flow hijack.\nA:H - The PoC triggers refcount_t addition-on-0 warnings, refcount underflow, and KASAN slab-use-after-free in mutex_lock, demonstrating immediate kernel memory corruption that can oops/panic and be repeated by re-running the race."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "785d908f8d21c8bc78b6fb2c2932ab662bf6918a", "versionType": "git"}, {"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8", "versionType": "git"}, {"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "145812b678de9f3b59780173be3c0d22ed60dd93", "versionType": "git"}, {"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "cc5bd568f9b7683e60841b6fd02c10d64535bd6e", "versionType": "git"}, {"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "1c206d461c680c3151daa3c89fc26eaf5bf98a7f", "versionType": "git"}, {"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "680fbd7942185448eadb990a3d10a53eb946b702", "versionType": "git"}, {"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "14e812ab41df0cac033479da835ec9a5de633404", "versionType": "git"}, {"status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "lessThan": "0e243671bc7b8eaf00f83dd2f4367436dc0cff98", "versionType": "git"}], "programFiles": ["include/net/addrconf.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.265", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.216", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.183", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.152", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.104", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.45", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.9", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/addrconf.h"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a"}, {"url": "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8"}, {"url": "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93"}, {"url": "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e"}, {"url": "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f"}, {"url": "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702"}, {"url": "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404"}, {"url": "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\n\nin6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\n\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\n\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\n\n refcount_t: addition on 0; use-after-free.\n ip6_mc_source+0xef4/0x17e0\n\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\n\n BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\n Write of size 8 at addr ffff888015b50240 by task poc/1219\n\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.265", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.216", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.183", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.152", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.104", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.45", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.9", "versionStartIncluding": "2.6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "2.6.19"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-25T05:40:54.475Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74630", "state": "PUBLISHED", "dateUpdated": "2026-10-16T19:06:03.622Z", "dateReserved": "2026-08-15T05:44:03.921Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-22T15:32:11.596Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/addrconf.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "785d908f8d21c8bc78b6fb2c2932ab662bf6918a", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}, {"lessThan": "aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}, {"lessThan": "145812b678de9f3b59780173be3c0d22ed60dd93", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}, {"lessThan": "cc5bd568f9b7683e60841b6fd02c10d64535bd6e", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}, {"lessThan": "1c206d461c680c3151daa3c89fc26eaf5bf98a7f", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}, {"lessThan": "680fbd7942185448eadb990a3d10a53eb946b702", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}, {"lessThan": "14e812ab41df0cac033479da835ec9a5de633404", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}, {"lessThan": "0e243671bc7b8eaf00f83dd2f4367436dc0cff98", "status": "affected", "version": "8814c4b533817df825485ff32ce6ac406c3a54d1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/addrconf.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.19"}, {"lessThan": "2.6.19", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.152", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.104", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.45", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\n\nin6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\n\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\n\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\n\n refcount_t: addition on 0; use-after-free.\n ip6_mc_source+0xef4/0x17e0\n\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\n\n BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\n Write of size 8 at addr ffff888015b50240 by task poc/1219\n\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nipv6: evitar que in6_dev_get() resucite inet6_dev\n\nin6_dev_get() lee dev -> ip6_ptr bajo RCU y luego incrementa incondicionalmente su refcount. La desinstalaci\u00f3n del dispositivo puede borrar el puntero y eliminar la \u00faltima referencia entre estas operaciones. El incremento entonces resucita un objeto cuya liberaci\u00f3n RCU ya ha sido encolada, por lo que los llamadores pueden usarlo despu\u00e9s de que sea liberado.\n\nUse refcount_inc_not_zero() y devuelva NULL cuando el objeto ya haya llegado a cero. RCU mantiene la memoria accesible a trav\u00e9s de la adquisici\u00f3n de referencia intentada, y un incremento exitoso fija el objeto para el llamador.\n\nUna ejecuci\u00f3n independiente en el kernel exacto sin parchear 6f5156d7a31a (v7.2-rc3) reprodujo la adquisici\u00f3n de referencia inv\u00e1lida como UID 1000:\n\n refcount_t: adici\u00f3n en 0; uso despu\u00e9s de liberaci\u00f3n.\n ip6_mc_source+0xef4/0x17e0\n\nFue seguido por el subdesbordamiento de referencia correspondiente en ip6_mc_source(). La traza proporcionada de la misma revisi\u00f3n sin parchear muestra adicionalmente el acceso despu\u00e9s de que termina la secci\u00f3n de lectura de RCU:\n\n BUG: KASAN: uso despu\u00e9s de liberaci\u00f3n de slab en mutex_lock+0x76/0xe0\n Escritura de tama\u00f1o 8 en la direcci\u00f3n ffff888015b50240 por la tarea PoC/1219\n\nError encontrado y clasificado por OpenAI Security Research y validado por Trail of Bits."}], "id": "CVE-2026-74630", "lastModified": "2026-10-16T20:17:48.063", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74630", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T19:02:57.486583Z", "version": "2.0.3"}}]}, "published": "2026-08-22T16:16:35.943", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ipv6: prevent in6_dev_get() from resurrecting inet6_dev", "id": "2521475", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2521475"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nipv6: prevent in6_dev_get() from resurrecting inet6_dev\nin6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally\nincrements its refcount. Device teardown can clear the pointer and drop\nthe last reference between these operations. The increment then\nresurrects an object whose RCU free has already been queued, so callers\ncan use it after it is freed.\nUse refcount_inc_not_zero() and return NULL when the object has already\nreached zero. RCU keeps the memory accessible through the attempted\nreference acquisition, and a successful increment pins the object for\nthe caller.\nAn independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)\nkernel reproduced the invalid reference acquisition as UID 1000:\nrefcount_t: addition on 0; use-after-free.\nip6_mc_source+0xef4/0x17e0\nIt was followed by the corresponding reference underflow in\nip6_mc_source(). The supplied trace from the same unpatched revision\nadditionally shows the access after the RCU read-side section ends:\nBUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0\nWrite of size 8 at addr ffff888015b50240 by task poc/1219\nBug found and triaged by OpenAI Security Research and\nvalidated by Trail of Bits.", "A flaw was found in the Linux kernel's IPv6 subsystem. The `in6_dev_get()` function can incorrectly increment the reference count of an `inet6_dev` object after it has been freed, leading to a use-after-free vulnerability. A local attacker could exploit this to cause memory corruption, potentially resulting in a denial of service or other undefined behavior."], "name": "CVE-2026-74630", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74630\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74630\nhttps://lore.kernel.org/linux-cve-announce/2026082221-CVE-2026-74630-8fae@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,785d908f8d21c8bc78b6fb2c2932ab662bf6918a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,145812b678de9f3b59780173be3c0d22ed60dd93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,cc5bd568f9b7683e60841b6fd02c10d64535bd6e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,1c206d461c680c3151daa3c89fc26eaf5bf98a7f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,680fbd7942185448eadb990a3d10a53eb946b702)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,14e812ab41df0cac033479da835ec9a5de633404)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8814c4b533817df825485ff32ce6ac406c3a54d1,0e243671bc7b8eaf00f83dd2f4367436dc0cff98)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.19"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.19)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.265,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.216,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.183,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.152,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.104,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.45,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.9,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-22T18:30:16.726840+00:00", "updated": "2026-08-25T17:30:07.657025+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}