CVE-2026-74581 in Linux
Summary
by MITRE • 08/21/2026
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: clear suppressed fib6 rule result
fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info.
If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release().
Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/21/2026
The vulnerability identified in the Linux kernel network stack involves a use-after-free condition within the IPv6 forwarding information base lookup logic, specifically affecting how routing rules handle suppressed routes. The core technical flaw resides in the fib6_rule_suppress function, which is responsible for dropping a route that has been marked as suppressed during the rule evaluation process. When this suppression occurs, the kernel correctly releases the underlying rt6_info structure using ip6_rt_put_flags to decrement reference counts and free memory resources associated with the routing entry. However, the implementation fails to nullify the res->rt6 pointer within the result structure after releasing the object. This oversight leaves a dangling pointer that references freed memory rather than indicating an absence of a valid route.
During subsequent operations in fib6_rule_lookup, if no later rule provides a replacement route, the function checks the res.rt6 field to determine whether a valid destination was found. Because this pointer was not cleared during suppression, it still points to the previously released rt6_info structure. Consequently, the lookup logic incorrectly interprets this stale reference as a valid routing entry and returns it to its caller, specifically rt6_lookup. This behavior effectively leaks a freed memory object back into active use within the networking subsystem, creating a classic use-after-free scenario that can lead to severe stability issues or potential exploitation vectors depending on how the kernel manages the reclaimed memory region.
The operational impact of this vulnerability is significant as it compromises the integrity of the network stack by allowing access to deallocated memory structures. When rt6_lookup receives this stale destination pointer, subsequent operations may attempt to dereference fields within the freed rt6_info structure. This can trigger undefined behavior, including kernel panics due to invalid memory accesses or data corruption if the memory has been reallocated for other purposes. Furthermore, the error propagates when the system attempts to release the route again; the next call to dst_release invokes rcuref_put_slowpath on an object that may no longer be validly mapped in kernel space, potentially causing a crash or facilitating remote code execution attacks if an attacker can control the contents of the freed memory region.
Mitigation strategies for this vulnerability involve applying the upstream Linux kernel patch that explicitly clears res->rt6 when suppressing a route. This ensures that suppressed lookups correctly fall through to return a null destination instead of reusing the released one, thereby maintaining proper state consistency within the routing lookup process. System administrators should update their kernels to versions where this fix is included. From a defensive perspective, organizations should ensure that kernel updates are applied promptly via standard patch management procedures. Additionally, enabling Kernel Address Sanitizer (KASAN) in development environments can help detect such memory safety violations early in the software lifecycle before they reach production deployments.
This issue aligns with Common Weakness Enumeration category CWE-416, which describes use after free vulnerabilities where a pointer is used after it has been freed, leading to unpredictable behavior or security breaches. In terms of attack vector classification under MITRE ATT&CK, this vulnerability relates to techniques involving memory corruption and exploitation of kernel-level flaws, potentially falling under privilege escalation if the resulting crash can be leveraged for denial of service against critical system services or further exploited for code execution within the kernel context. Proper handling of resource lifecycles in network subsystems is essential to prevent such logical errors from compromising overall system security posture.