CVE-2026-74630 in Linux
Summary
by MITRE • 08/22/2026
In the Linux kernel, the following vulnerability has been resolved:
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The increment then resurrects an object whose RCU free has already been queued, so callers can use it after it is freed.
Use refcount_inc_not_zero() and return NULL when the object has already reached zero. RCU keeps the memory accessible through the attempted reference acquisition, and a successful increment pins the object for the caller.
An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3) kernel reproduced the invalid reference acquisition as UID 1000:
refcount_t: addition on 0; use-after-free. ip6_mc_source+0xef4/0x17e0
It was followed by the corresponding reference underflow in ip6_mc_source(). The supplied trace from the same unpatched revision additionally shows the access after the RCU read-side section ends:
BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0 Write of size 8 at addr ffff888015b50240 by task poc/1219
Bug found and triaged by OpenAI Security Research and validated by Trail of Bits.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/22/2026
The Linux kernel vulnerability identified in the ipv6 subsystem involves a critical race condition within the in6_dev_get() function, which is responsible for retrieving pointer references to IPv6 device structures. The core technical flaw lies in the sequence of operations performed under Read-Copy-Update (RCU) protection. Specifically, the function reads the dev->ip6_ptr field and then unconditionally increments its reference count without verifying if that object has already been marked for destruction. During network interface teardown processes, it is possible for the pointer to be cleared and the final reference dropped between these two steps. Consequently, when in6_dev_get() proceeds to increment a zeroed refcount, it effectively resurrects an object whose RCU free operation had already been queued but not yet completed. This creates a scenario where subsequent code paths can access memory that is scheduled for deallocation, leading to use-after-free conditions and potential kernel instability or privilege escalation vectors depending on the exploitability of the accessed data structures.
The operational impact of this vulnerability is significant as it allows processes with standard user privileges, such as UID 1000, to trigger invalid reference acquisitions within critical networking code paths like ip6_mc_source(). Independent validation using an unpatched kernel version v7.2-rc3 confirmed that triggering this race condition results in a refcount_t addition on zero, which is flagged by the Kernel Address Sanitizer (KASAN) as a use-after-free error. The resulting underflow of reference counts can corrupt internal kernel state, potentially leading to crashes or exploitable memory corruption scenarios where an attacker gains control over freed slab objects. This undermines the integrity and availability of network services running on affected systems, particularly those relying heavily on IPv6 multicast operations which interact with these device management structures.
To mitigate this vulnerability, the Linux kernel developers implemented a fix that replaces the unconditional reference increment with refcount_inc_not_zero(). This atomic operation checks if the reference count is already zero before attempting to increment it. If the object has reached zero and is being torn down, the function returns NULL instead of resurrecting the object. RCU mechanisms ensure that the memory remains accessible during this check, preventing immediate segmentation faults while allowing safe detection of the object's lifecycle status. This change ensures that callers only receive valid pointers to live objects, thereby eliminating the race window where a freed object could be accessed. System administrators should apply kernel updates containing this patch immediately to restore proper reference counting semantics and prevent potential exploitation through crafted network operations or local privilege escalation attempts targeting IPv6 device management routines.