CVE-2026-64572 in Linux
Summary
by MITRE • 08/05/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free().
fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free:
BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56
Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough.
Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/05/2026
This vulnerability exists in the linux kernel's ipv4 forwarding information base implementation where a use-after-free condition can occur during fib table insertion operations. The flaw manifests when fib_table_insert() publishes a new fib alias into the leaf's fa_list using fib_insert_alias() before invoking fib entry notifiers, creating a race condition with concurrent lookups. When a notifier fails and triggers the error path, the system removes the new_fib_alias with fib_remove_alias() which performs hlist_del_rcu() but immediately frees it using kmem_cache_free() instead of the proper rcu freeing mechanism.
The operational impact stems from the fact that fib_table_lookup() traverses the linked list under rcu_read_lock() exclusively, meaning concurrent lookups can access memory that has already been freed by the error path. This creates a classic use-after-free scenario where a lookup operation attempts to read from memory location ffff88810676d4eb after it was deallocated, resulting in a kernel memory safety violation detected by KASAN. The attack vector requires CAP_NET_ADMIN privileges and a registered fib notifier capable of rejecting routes, making it exploitable through network device manipulation.
The vulnerability demonstrates a clear deviation from proper rcu usage patterns as established in the linux kernel's memory management practices. According to CWE-416, this represents a use-after-free condition where memory is accessed after being freed, while the ATT&CK framework would categorize this as a privilege escalation technique through kernel memory corruption. The fix requires changing the freeing mechanism from kmem_cache_free() to alias_free_mem_rcu() for consistency with how fib_table_delete() handles fib_alias removals from the trie structure, ensuring proper rcu grace period handling before memory deallocation.
This particular flaw highlights the complexity of concurrent data structure management in kernel space where multiple threads access shared resources under different locking mechanisms. The race condition occurs between the publication of new fib entries and the potential rollback during error handling, demonstrating that even seemingly simple operations can expose critical security vulnerabilities when proper synchronization primitives are not applied consistently throughout the code path. The fix ensures that all alias removals follow the same rcu-based freeing pattern, preventing the memory safety violation that could potentially be leveraged for privilege escalation or system instability.
The vulnerability affects network stack operations in linux systems where ipv4 routing table modifications occur, particularly impacting systems running with network administration capabilities and those managing extensive fib table configurations. The error path specifically targets scenarios involving exhausted ipv4 fib resources, making it relevant to high-traffic network environments or systems under resource constraints. Proper mitigation involves applying the kernel patch that standardizes the rcu freeing mechanism across all alias removal operations within the fib table implementation.