GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74289 (GCVE-0-2026-74289)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). syzbot reported use-after-free in nsim_fib4_prepare_event(). [0] The problem is that the following functions call fib_info_hold() / refcount_inc() while dumping fib_info under RCU, which is unsafe. * mlxsw_sp_router_fib4_event() * rocker_router_fib_event() * nsim_fib4_prepare_event() refcount_inc_not_zero() must be used, but it would be too late there. Let's guarantee the lifetime of fib_info in fib_leaf_notify(). Note that IPv6 does not need the corresponding change since fib6_table_dump() holds fib6_table.tb6_lock. [0]: refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420 Modules linked in: CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25 Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a <67> 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f RSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293 RAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0 RBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005 R10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000 R13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000 FS: 0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0 Call Trace: <TASK> __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] fib_info_hold include/net/ip_fib.h:629 [inline] nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline] nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline] nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043 call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25 call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline] fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline] fib_table_notify net/ipv4/fib_trie.c:2194 [inline] fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217 fib_net_dump net/core/fib_notifier.c:70 [inline] register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108 nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596 nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline] nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058 devlink_reload+0x501/0x8d0 net/devlink/dev.c:475 devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0x940 net/core/net_namespace.c:234 cleanup_net+0x56e/0x800 net/core/net_namespace.c:702 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK>
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: c3852ef7f2f8f75a9f85a864bec1f6f5a3068eea , < 676482da8d938ea72c26da0fc86af2d2ec238ab2 (git)
Affected: c3852ef7f2f8f75a9f85a864bec1f6f5a3068eea , < 06b693d2eb6651a63ad85bad8673de3b7d4edd6d (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.10
Unaffected: 0 , < 4.10 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_fib.h",
            "net/ipv4/fib_trie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "676482da8d938ea72c26da0fc86af2d2ec238ab2",
              "status": "affected",
              "version": "c3852ef7f2f8f75a9f85a864bec1f6f5a3068eea",
              "versionType": "git"
            },
            {
              "lessThan": "06b693d2eb6651a63ad85bad8673de3b7d4edd6d",
              "status": "affected",
              "version": "c3852ef7f2f8f75a9f85a864bec1f6f5a3068eea",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip_fib.h",
            "net/ipv4/fib_trie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.10"
            },
            {
              "lessThan": "4.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: Don\u0027t dump dying fib_info in fib_leaf_notify().\n\nsyzbot reported use-after-free in nsim_fib4_prepare_event(). [0]\n\nThe problem is that the following functions call fib_info_hold() /\nrefcount_inc() while dumping fib_info under RCU, which is unsafe.\n\n  * mlxsw_sp_router_fib4_event()\n  * rocker_router_fib_event()\n  * nsim_fib4_prepare_event()\n\nrefcount_inc_not_zero() must be used, but it would be too late\nthere.\n\nLet\u0027s guarantee the lifetime of fib_info in fib_leaf_notify().\n\nNote that IPv6 does not need the corresponding change since\nfib6_table_dump() holds fib6_table.tb6_lock.\n\n[0]:\nrefcount_t: addition on 0; use-after-free.\nWARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420\nModules linked in:\nCPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25\nCode: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a \u003c67\u003e 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f\nRSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293\nRAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0\nRBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000\nR13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000\nFS:  0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __refcount_add include/linux/refcount.h:-1 [inline]\n __refcount_inc include/linux/refcount.h:366 [inline]\n refcount_inc include/linux/refcount.h:383 [inline]\n fib_info_hold include/net/ip_fib.h:629 [inline]\n nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline]\n nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline]\n nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043\n call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25\n call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline]\n fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline]\n fib_table_notify net/ipv4/fib_trie.c:2194 [inline]\n fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217\n fib_net_dump net/core/fib_notifier.c:70 [inline]\n register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108\n nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596\n nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline]\n nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058\n devlink_reload+0x501/0x8d0 net/devlink/dev.c:475\n devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558\n ops_pre_exit_list net/core/net_namespace.c:161 [inline]\n ops_undo_list+0x187/0x940 net/core/net_namespace.c:234\n cleanup_net+0x56e/0x800 net/core/net_namespace.c:702\n process_one_work kernel/workqueue.c:3314 [inline]\n process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397\n worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local netlink syscalls (rtnetlink route add/delete and devlink reload/netns teardown) that invoke register_fib_notifier()-\u003efib_leaf_notify(); it is not reachable by sending remote IP packets.\nAC:L - The bug is a race between RCU FIB table dump and concurrent route deletion; an attacker controls both sides by churning routes while triggering devlink reload or network-namespace cleanup that registers a FIB notifier.\nPR:L - Route manipulation and devlink operations require CAP_NET_ADMIN in the target network namespace, which an unprivileged local user can obtain via user+network namespaces; cloud/container hosts with Mellanox mlx5/mlxsw also expose this via NET_ADMIN.\nUI:N - No victim interaction is required; the attacker creates routes, triggers FIB notifier registration/dump, and concurrently deletes routes or destroys the namespace themselves.\nS:U - Impact is a kernel heap use-after-free within the host networking stack; it does not cross VM, container, or IOMMU security boundaries (standard kernel privilege escalation remains scope Unchanged).\nC:H - Use-after-free on fib_info during RCU dump (refcount_inc on zero in fib_info_hold); syzbot confirmed dying fib_info access, enabling disclosure of freed slab contents and kernel pointer leaks for further exploitation.\nI:H - UAF on fib_info allows attacker-controlled heap reuse of the freed object, enabling arbitrary kernel memory corruption, control-flow hijack, and local privilege escalation beyond the demonstrated refcount warning.\nA:H - Demonstrated kernel refcount UAF warning/crash path during fib_info_hold; repeated triggering via route churn plus devlink reload/netns cleanup can panic or hang the host, causing system-wide denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:28.941Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/676482da8d938ea72c26da0fc86af2d2ec238ab2"
        },
        {
          "url": "https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d"
        }
      ],
      "title": "ipv4: fib: Don\u0027t dump dying fib_info in fib_leaf_notify().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74289",
    "datePublished": "2026-08-15T05:57:56.383Z",
    "dateReserved": "2026-08-15T05:44:03.881Z",
    "dateUpdated": "2026-08-17T05:45:28.941Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74289",
      "date": "2026-09-10",
      "epss": "0.0012",
      "percentile": "0.021"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-23T14:55:40.000Z",
      "cve": "CVE-2026-74289",
      "id": "msrc_CVE-2026-74289",
      "initial_release_date": "2026-08-23T14:55:40.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipv4: fib: Don\u0027t dump dying fib_info in fib_leaf_notify().",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74289.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74289\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-15T06:22:28.457\",\"lastModified\":\"2026-08-17T06:19:22.843\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv4: fib: Don\u0027t dump dying fib_info in fib_leaf_notify().\\n\\nsyzbot reported use-after-free in nsim_fib4_prepare_event(). [0]\\n\\nThe problem is that the following functions call fib_info_hold() /\\nrefcount_inc() while dumping fib_info under RCU, which is unsafe.\\n\\n  * mlxsw_sp_router_fib4_event()\\n  * rocker_router_fib_event()\\n  * nsim_fib4_prepare_event()\\n\\nrefcount_inc_not_zero() must be used, but it would be too late\\nthere.\\n\\nLet\u0027s guarantee the lifetime of fib_info in fib_leaf_notify().\\n\\nNote that IPv6 does not need the corresponding change since\\nfib6_table_dump() holds fib6_table.tb6_lock.\\n\\n[0]:\\nrefcount_t: addition on 0; use-after-free.\\nWARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420\\nModules linked in:\\nCPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)}\\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\\nWorkqueue: netns cleanup_net\\nRIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25\\nCode: eb 66 85 db 74 3e 83 fb 01 75 4c e8 1b f1 22 fd 48 8d 3d 84 cb f1 0a 67 48 0f b9 3a eb 4a e8 08 f1 22 fd 48 8d 3d 81 cb f1 0a \u003c67\u003e 48 0f b9 3a eb 37 e8 f5 f0 22 fd 48 8d 3d 7e cb f1 0a 67 48 0f\\nRSP: 0018:ffffc9000f2c7270 EFLAGS: 00010293\\nRAX: ffffffff84a18858 RBX: 0000000000000002 RCX: ffff888032ff9ec0\\nRDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8f9353e0\\nRBP: 0000000000000000 R08: ffff888032ff9ec0 R09: 0000000000000005\\nR10: 0000000000000100 R11: 0000000000000004 R12: ffff8880570cc000\\nR13: dffffc0000000000 R14: ffff88802b40563c R15: ffff8880570cc000\\nFS:  0000000000000000(0000) GS:ffff888126173000(0000) knlGS:0000000000000000\\nCS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\\nCR2: 00007fb1f4d5d000 CR3: 000000006072a000 CR4: 00000000003526f0\\nCall Trace:\\n \u003cTASK\u003e\\n __refcount_add include/linux/refcount.h:-1 [inline]\\n __refcount_inc include/linux/refcount.h:366 [inline]\\n refcount_inc include/linux/refcount.h:383 [inline]\\n fib_info_hold include/net/ip_fib.h:629 [inline]\\n nsim_fib4_prepare_event drivers/net/netdevsim/fib.c:930 [inline]\\n nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1000 [inline]\\n nsim_fib_event_nb+0x1055/0x1240 drivers/net/netdevsim/fib.c:1043\\n call_fib_notifier+0x45/0x80 net/core/fib_notifier.c:25\\n call_fib_entry_notifier net/ipv4/fib_trie.c:90 [inline]\\n fib_leaf_notify net/ipv4/fib_trie.c:2176 [inline]\\n fib_table_notify net/ipv4/fib_trie.c:2194 [inline]\\n fib_notify+0x36b/0x5e0 net/ipv4/fib_trie.c:2217\\n fib_net_dump net/core/fib_notifier.c:70 [inline]\\n register_fib_notifier+0x184/0x360 net/core/fib_notifier.c:108\\n nsim_fib_create+0x85d/0x9f0 drivers/net/netdevsim/fib.c:1596\\n nsim_dev_reload_create drivers/net/netdevsim/dev.c:1604 [inline]\\n nsim_dev_reload_up+0x374/0x7c0 drivers/net/netdevsim/dev.c:1058\\n devlink_reload+0x501/0x8d0 net/devlink/dev.c:475\\n devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:558\\n ops_pre_exit_list net/core/net_namespace.c:161 [inline]\\n ops_undo_list+0x187/0x940 net/core/net_namespace.c:234\\n cleanup_net+0x56e/0x800 net/core/net_namespace.c:702\\n process_one_work kernel/workqueue.c:3314 [inline]\\n process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397\\n worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478\\n kthread+0x388/0x470 kernel/kthread.c:436\\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\\n \u003c/TASK\u003e\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/ip_fib.h\",\"net/ipv4/fib_trie.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c3852ef7f2f8f75a9f85a864bec1f6f5a3068eea\",\"lessThan\":\"676482da8d938ea72c26da0fc86af2d2ec238ab2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c3852ef7f2f8f75a9f85a864bec1f6f5a3068eea\",\"lessThan\":\"06b693d2eb6651a63ad85bad8673de3b7d4edd6d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/ip_fib.h\",\"net/ipv4/fib_trie.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"4.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"4.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/06b693d2eb6651a63ad85bad8673de3b7d4edd6d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/676482da8d938ea72c26da0fc86af2d2ec238ab2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T15:19:12+00:00",
      "cve": "CVE-2026-74289",
      "id": "CVE-2026-74289",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv4: fib: Don\u0027t dump dying fib_info in fib_leaf_notify()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74289.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.