CVE-2026-74561 (GCVE-0-2026-74561)

Vulnerability from cvelistv5 – Published: 2026-08-15 12:28 – Updated: 2026-08-17 05:48
VLAI
Title
nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush
Summary
In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()): BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243) Read of size 8 at addr ffff888012953e18 by task exploit/146 nh_rt_cache_flush (net/ipv4/nexthop.c:2243) replace_nexthop (net/ipv4/nexthop.c:2610) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) Unlike the other f6i_list walks, this one bumps each route's sernum via fib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock around it would invert the established tb6_lock -> nh->lock order and deadlock. As the only purpose is to invalidate cached dsts, bump the IPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead, mirroring the rt_cache_flush() already done for IPv4 just above.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 081efd18326e353c6fbfdeff903a83edde953f72 , < 44f53e4331a30fabc38a411fae7524341b618db3 (git)
Affected: 081efd18326e353c6fbfdeff903a83edde953f72 , < 4787a6d2629b4e8c0b6bacab1f75c1660eca44d9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 7.1.8 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "44f53e4331a30fabc38a411fae7524341b618db3",
              "status": "affected",
              "version": "081efd18326e353c6fbfdeff903a83edde953f72",
              "versionType": "git"
            },
            {
              "lessThan": "4787a6d2629b4e8c0b6bacab1f75c1660eca44d9",
              "status": "affected",
              "version": "081efd18326e353c6fbfdeff903a83edde953f72",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/nexthop.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh-\u003ef6i_list during an RTNL-serialized nexthop\nreplace without holding nh-\u003elock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh-\u003elock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n  BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n  Read of size 8 at addr ffff888012953e18 by task exploit/146\n   nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n   replace_nexthop (net/ipv4/nexthop.c:2610)\n   rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route\u0027s sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh-\u003elock\naround it would invert the established tb6_lock -\u003e nh-\u003elock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The slab use-after-free is reached only via local RTNETLINK on AF_NETLINK sockets: RTM_NEWNEXTHOP with NLM_F_REPLACE drives replace_nexthop()-\u003enh_rt_cache_flush(), racing concurrent RTM_NEWROUTE/RTM_DELROUTE IPv6 route changes; it is not triggered by remote packet processing.\nAC:L - The race is attacker-controlled: one thread replaces a nexthop under rtnl_net_lock while another concurrently adds/deletes IPv6 routes via unlocked inet6_rtm_newroute/inet6_rtm_delroute handlers; Microsoft reproduced reliable KASAN slab-use-after-free with this pattern.\nPR:L - rtnetlink_rcv_msg() requires CAP_NET_ADMIN via netlink_net_capable() for all non-GET handlers; unprivileged local users obtain this inside a user/network namespace (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through coordinated local netlink nexthop replace and IPv6 route add/delete commands from attacker-controlled processes.\nS:C - A successful UAF from CAP_NET_ADMIN inside an unprivileged user/network namespace corrupts host kernel slab memory and can escape the namespace/container sandbox to compromise the host system, crossing the container-to-host security boundary.\nC:H - The unlocked nh-\u003ef6i_list walk dereferences freed fib6_info objects (KASAN read of size 8 at nh_rt_cache_flush), enabling arbitrary kernel memory disclosure via slab heap reuse of attacker-groomed objects.\nI:H - Beyond the UAF read, fib6_update_sernum_upto_root() writes fn_sernum through stale fib6_info/fib6_table pointers; slab UAF on fib6_info provides memory corruption primitives for arbitrary kernel writes and local privilege escalation.\nA:H - The confirmed KASAN slab-use-after-free in nh_rt_cache_flush during nexthop replace causes kernel oops/panic; UAF list walks are inherently crash-prone and can be triggered repeatedly for denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:48:40.842Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3"
        },
        {
          "url": "https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9"
        }
      ],
      "title": "nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74561",
    "datePublished": "2026-08-15T12:28:04.525Z",
    "dateReserved": "2026-08-15T05:44:03.916Z",
    "dateUpdated": "2026-08-17T05:48:40.842Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74561",
      "date": "2026-10-01",
      "epss": "0.00165",
      "percentile": "0.05109"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/nexthop.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "44f53e4331a30fabc38a411fae7524341b618db3",
                    "status": "affected",
                    "version": "081efd18326e353c6fbfdeff903a83edde953f72",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4787a6d2629b4e8c0b6bacab1f75c1660eca44d9",
                    "status": "affected",
                    "version": "081efd18326e353c6fbfdeff903a83edde953f72",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/ipv4/nexthop.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.8",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh-\u003ef6i_list during an RTNL-serialized nexthop\nreplace without holding nh-\u003elock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh-\u003elock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n  BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n  Read of size 8 at addr ffff888012953e18 by task exploit/146\n   nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n   replace_nexthop (net/ipv4/nexthop.c:2610)\n   rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route\u0027s sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh-\u003elock\naround it would invert the established tb6_lock -\u003e nh-\u003elock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above."
          }
        ],
        "id": "CVE-2026-74561",
        "lastModified": "2026-08-17T06:19:54.190",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T13:18:01.590",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-17T15:01:01+00:00",
      "cve": "CVE-2026-74561",
      "id": "CVE-2026-74561",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74561.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-18T16:53:44Z",
      "cve": "CVE-2026-74561",
      "id": "CVE-2026-74561",
      "initial_release_date": "2026-08-15T23:50:11Z",
      "product_status:known_not_affected": "284",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74561",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74561.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.