Vulnerability-Lookup

CVE-2026-74581 (GCVE-0-2026-74581)

Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40

Title

net: ipv6: clear suppressed fib6 rule result

Summary

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/90c57310e266eb94e…
https://git.kernel.org/stable/c/5d29b286c9de0b309…
https://git.kernel.org/stable/c/354db6243eca59e9d…
https://git.kernel.org/stable/c/6d98c70fe0ba8c770…
https://git.kernel.org/stable/c/9bad152c42b374991…
https://git.kernel.org/stable/c/dc3ab04220667f254…
https://git.kernel.org/stable/c/a341c091ca0bfae37…
https://git.kernel.org/stable/c/6aea62e433fe1b586…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 209d35ee34e25f9668c404350a1c86d914c54ffa , < 90c57310e266eb94e4a80d6b15a9ca131d2e82cb (git) Affected: 8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383 , < 5d29b286c9de0b309e94b9ed083aa1a2f429434f (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 354db6243eca59e9d187ffbf8b7955b044ce84dc (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 9bad152c42b37499162367fe47867411e62fffa3 (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < dc3ab04220667f254f4348572b2a0b3febff89fb (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < a341c091ca0bfae377747b1b59a3bd8ebe18a937 (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 6aea62e433fe1b586202a5fee8b5807ce635e1d7 (git) Affected: ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29 (git) Affected: 5.10.84 , < 5.10.265 (semver) Affected: 5.15.7 , < 5.15.216 (semver) Affected: 5.4.164 , < 5.5 (semver)	guessed
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/fib6_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb",
              "status": "affected",
              "version": "209d35ee34e25f9668c404350a1c86d914c54ffa",
              "versionType": "git"
            },
            {
              "lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f",
              "status": "affected",
              "version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383",
              "versionType": "git"
            },
            {
              "lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "9bad152c42b37499162367fe47867411e62fffa3",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.84",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.216",
              "status": "affected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.164",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/fib6_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.15.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.164",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res-\u003ert6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:07.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"
        },
        {
          "url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"
        }
      ],
      "title": "net: ipv6: clear suppressed fib6 rule result",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74581",
    "datePublished": "2026-08-21T16:31:54.683Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-25T05:40:07.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74581",
      "date": "2026-08-24",
      "epss": "0.00165",
      "percentile": "0.05837"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:44:07.000Z",
      "cve": "CVE-2026-74581",
      "id": "msrc_CVE-2026-74581",
      "initial_release_date": "2026-08-23T01:03:26.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net: ipv6: clear suppressed fib6 rule result",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74581.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74581\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-21T17:16:44.363\",\"lastModified\":\"2026-08-25T06:18:31.437\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet: ipv6: clear suppressed fib6 rule result\\n\\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\\nbut leaves res-\u003ert6 pointing at the released rt6_info.\\n\\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\\ntherefore leak a released route back to rt6_lookup(), and the next put\\nhits rcuref_put_slowpath() from dst_release().\\n\\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\\nthrough to the null dst instead of reusing the released one.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv6/fib6_rules.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"209d35ee34e25f9668c404350a1c86d914c54ffa\",\"lessThan\":\"90c57310e266eb94e4a80d6b15a9ca131d2e82cb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383\",\"lessThan\":\"5d29b286c9de0b309e94b9ed083aa1a2f429434f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdef485217d30382f3bf6448c54b4401648fe3f1\",\"lessThan\":\"354db6243eca59e9d187ffbf8b7955b044ce84dc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdef485217d30382f3bf6448c54b4401648fe3f1\",\"lessThan\":\"6d98c70fe0ba8c7708bfd5b2a5174d2086775daa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdef485217d30382f3bf6448c54b4401648fe3f1\",\"lessThan\":\"9bad152c42b37499162367fe47867411e62fffa3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdef485217d30382f3bf6448c54b4401648fe3f1\",\"lessThan\":\"dc3ab04220667f254f4348572b2a0b3febff89fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdef485217d30382f3bf6448c54b4401648fe3f1\",\"lessThan\":\"a341c091ca0bfae377747b1b59a3bd8ebe18a937\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"cdef485217d30382f3bf6448c54b4401648fe3f1\",\"lessThan\":\"6aea62e433fe1b586202a5fee8b5807ce635e1d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.84\",\"lessThan\":\"5.10.265\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.7\",\"lessThan\":\"5.15.216\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.4.164\",\"lessThan\":\"5.5\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv6/fib6_rules.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.151\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.103\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.44\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.8\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-25T06:02:26+00:00",
      "cve": "CVE-2026-74581",
      "id": "CVE-2026-74581",
      "initial_release_date": "2026-08-21T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res-\u003ert6 pointer",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74581.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-23T16:41:53Z",
      "cve": "CVE-2026-74581",
      "id": "CVE-2026-74581",
      "initial_release_date": "2026-08-22T00:52:35Z",
      "product_status:known_affected": "129",
      "product_status:known_not_affected": "155",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74581",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74581.json",
      "version": "4"
    }
  }
}

FKIE_CVE-2026-74581

Vulnerability from fkie_nvd - Published: 2026-08-21 17:16 - Updated: 2026-08-21 17:16

Severity

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/fib6_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb",
              "status": "affected",
              "version": "209d35ee34e25f9668c404350a1c86d914c54ffa",
              "versionType": "git"
            },
            {
              "lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f",
              "status": "affected",
              "version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383",
              "versionType": "git"
            },
            {
              "lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "9bad152c42b37499162367fe47867411e62fffa3",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.84",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.216",
              "status": "affected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.164",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/fib6_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."
    }
  ],
  "id": "CVE-2026-74581",
  "lastModified": "2026-08-21T17:16:44.363",
  "metrics": {},
  "published": "2026-08-21T17:16:44.363",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-7PH7-58W3-W755

Vulnerability from github – Published: 2026-08-21 18:34 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: clear suppressed fib6 rule result

fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info.

If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release().

Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74581"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-21T17:16:44Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one.",
  "id": "GHSA-7ph7-58w3-w755",
  "modified": "2026-08-25T06:31:21Z",
  "published": "2026-08-21T18:34:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74581"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-74581

Vulnerability from csaf_microsoft - Published: 2026-08-23 01:03 - Updated: 2026-08-24 14:44

Summary

net: ipv6: clear suppressed fib6 rule result

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74581

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74581 net: ipv6: clear suppressed fib6 rule result - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74581.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "net: ipv6: clear suppressed fib6 rule result",
    "tracking": {
      "current_release_date": "2026-08-24T14:44:07.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.239Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74581",
      "initial_release_date": "2026-08-23T01:03:26.000Z",
      "revision_history": [
        {
          "date": "2026-08-23T01:03:26.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:44:07.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74581",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74581 net: ipv6: clear suppressed fib6 rule result - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74581.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-23T01:03:26.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "net: ipv6: clear suppressed fib6 rule result"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74581 (GCVE-0-2026-74581)

FKIE_CVE-2026-74581

GHSA-7PH7-58W3-W755

MSRC_CVE-2026-74581

Tags

Sightings

Nomenclature