Vulnerability-Lookup

CVE-2026-74583 (GCVE-0-2026-74583)

Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40

Title

net/sched: cls_route: fix fastmap use-after-free on filter

Summary

In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter. This creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed 4. After the RCU grace period, kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths. Fix: Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers.

Severity

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/7897198b26445b400…
https://git.kernel.org/stable/c/820f083c294ad6d31…
https://git.kernel.org/stable/c/5ec9001be6d0eb527…
https://git.kernel.org/stable/c/b969984b2bdc85d72…
https://git.kernel.org/stable/c/a17f636c9330eac87…
https://git.kernel.org/stable/c/0e7a8cf8895b06d07…
https://git.kernel.org/stable/c/ae9aff87025219005…
https://git.kernel.org/stable/c/47d7f7051253bdc02…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 7897198b26445b4009a057bda1986b94a99e5d5f (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 820f083c294ad6d319c02a7d43294f2ed2565139 (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 5ec9001be6d0eb527251125632ec8fe88278897f (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < b969984b2bdc85d721ce4047cd270cd37ec705a2 (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < a17f636c9330eac879822ce29f998e5abd1b72c1 (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 0e7a8cf8895b06d07c7311f028eba16ad742b9bc (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < ae9aff87025219005a2d16b4fe83d6f24643e50d (git) Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 47d7f7051253bdc02b1d245d87e38f16d31a74df (git)	guessed
Linux	Linux	Affected: 3.18 Unaffected: 0 , < 3.18 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.152 , ≤ 6.6.* (semver) Unaffected: 6.12.104 , ≤ 6.12.* (semver) Unaffected: 6.18.45 , ≤ 6.18.* (semver) Unaffected: 7.1.9 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7897198b26445b4009a057bda1986b94a99e5d5f",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "820f083c294ad6d319c02a7d43294f2ed2565139",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "5ec9001be6d0eb527251125632ec8fe88278897f",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "b969984b2bdc85d721ce4047cd270cd37ec705a2",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "a17f636c9330eac879822ce29f998e5abd1b72c1",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "0e7a8cf8895b06d07c7311f028eba16ad742b9bc",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "ae9aff87025219005a2d16b4fe83d6f24643e50d",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "47d7f7051253bdc02b1d245d87e38f16d31a74df",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n    *after* the writer\u0027s reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n    fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local rtnetlink RTM_NEWTFILTER/RTM_DELTFILTER (tc filter add/change/del route) through sendmsg\u2192rtnetlink_rcv_msg\u2192tc_new_tfilter/tc_del_tfilter\u2192route4_change/route4_delete; remote packets alone cannot trigger the filter-deletion side of the race.\nAC:L - The attacker controls both race sides\u2014concurrent route filter add/change/delete via netlink plus traffic through route4_classify on clsact/ingress/egress qdiscs; ZDI and independent reporter stress tests reproduced KASAN slab-use-after-free without uncontrollable prerequisites.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN), evaluated against the target network namespace user_ns; an unprivileged local user obtains CAP_NET_ADMIN via user+network namespaces (unshare -Urn) and configures clsact with route filters.\nUI:N - No victim interaction is needed; the attacker configures the route classifier, drives concurrent filter churn, and generates matching traffic from their own processes.\nS:U - Impact is kernel memory corruption within the same kernel security boundary (local privilege escalation/DoS); it does not cross VM, hypervisor, or IOMMU boundaries.\nC:H - Slab use-after-free: a stale fastmap entry retains a freed route4_filter pointer and route4_classify dereferences f-\u003eres from freed kmalloc memory; KASAN confirmed slab-use-after-free, enabling arbitrary kernel read via heap reclaim/spray.\nI:H - UAF of the kmalloc route4_filter object allows attacker-controlled heap spraying to reclaim the freed slot and obtain write/control-flow hijacking primitives; memory corruption is exploitable beyond a simple crash.\nA:H - UAF on the fastmap hot path causes kernel oops/panic under concurrent filter churn; KASAN slab-use-after-free was confirmed during add/delete stress testing, providing reliable denial of service even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:10.077Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d"
        },
        {
          "url": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df"
        }
      ],
      "title": "net/sched: cls_route: fix fastmap use-after-free on filter",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74583",
    "datePublished": "2026-08-21T16:31:55.886Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-25T05:40:10.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74583",
      "date": "2026-08-25",
      "epss": "0.00117",
      "percentile": "0.01832"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-24T14:44:01.000Z",
      "cve": "CVE-2026-74583",
      "id": "msrc_CVE-2026-74583",
      "initial_release_date": "2026-08-23T01:03:20.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: cls_route: fix fastmap use-after-free on filter",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74583.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74583\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-21T17:16:44.643\",\"lastModified\":\"2026-08-25T06:18:32.033\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: cls_route: fix fastmap use-after-free on filter\\n\\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\\nstruct route4_filter pointers indexed by (id, iif). The reader\\n(route4_classify) populates this cache via route4_set_fastmap() for every\\nclassified packet that hits a filter. The writer (route4_delete,\\nroute4_change) clears the cache via route4_reset_fastmap() before\\nRCU-deferred kfree of the filter.\\n\\nThis creates a UAF race:\\n 1. Reader walks the RCU-protected bucket chain, finds filter f\\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\\n 3. Reader calls route4_set_fastmap() and writes f into the cache\\n    *after* the writer\u0027s reset, caching a pointer about to be freed\\n 4. After the RCU grace period, kfree(f) executes\\n 5. Next classified packet on the same (id, iif) tuple hits the stale\\n    fastmap entry and reads f-\u003eres from freed memory\\n\\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\\nconcurrent add/delete stress test (provided by both zdi and Santosh).\\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\\npaths.\\n\\nFix:\\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\\nrepublishing by in-flight readers.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/cls_route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"7897198b26445b4009a057bda1986b94a99e5d5f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"820f083c294ad6d319c02a7d43294f2ed2565139\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"5ec9001be6d0eb527251125632ec8fe88278897f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"b969984b2bdc85d721ce4047cd270cd37ec705a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"a17f636c9330eac879822ce29f998e5abd1b72c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"0e7a8cf8895b06d07c7311f028eba16ad742b9bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"ae9aff87025219005a2d16b4fe83d6f24643e50d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"47d7f7051253bdc02b1d245d87e38f16d31a74df\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/cls_route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-26T09:31:23+00:00",
      "cve": "CVE-2026-74583",
      "id": "CVE-2026-74583",
      "initial_release_date": "2026-08-21T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: cls_route: fix fastmap use-after-free on filter",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74583.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-22T16:28:19Z",
      "cve": "CVE-2026-74583",
      "id": "CVE-2026-74583",
      "initial_release_date": "2026-08-22T00:52:31Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74583",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74583.json",
      "version": "3"
    }
  }
}

FKIE_CVE-2026-74583

Vulnerability from fkie_nvd - Published: 2026-08-21 17:16 - Updated: 2026-08-25 06:18

Severity

7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Summary

References

	URL	Tags
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d
	416baaa9-dc9f-4396-8d5f-8c081fb06d67	https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7897198b26445b4009a057bda1986b94a99e5d5f",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "820f083c294ad6d319c02a7d43294f2ed2565139",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "5ec9001be6d0eb527251125632ec8fe88278897f",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "b969984b2bdc85d721ce4047cd270cd37ec705a2",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "a17f636c9330eac879822ce29f998e5abd1b72c1",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "0e7a8cf8895b06d07c7311f028eba16ad742b9bc",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "ae9aff87025219005a2d16b4fe83d6f24643e50d",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "47d7f7051253bdc02b1d245d87e38f16d31a74df",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n    *after* the writer\u0027s reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n    fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers."
    }
  ],
  "id": "CVE-2026-74583",
  "lastModified": "2026-08-25T06:18:32.033",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "HIGH",
          "baseScore": 7.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.8,
        "impactScore": 5.9,
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary"
      }
    ]
  },
  "published": "2026-08-21T17:16:44.643",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}

GHSA-QM4P-6QR9-F3W6

Vulnerability from github – Published: 2026-08-21 18:34 – Updated: 2026-08-25 06:31

Details

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_route: fix fastmap use-after-free on filter

The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter.

This creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into the cache after the writer's reset, caching a pointer about to be freed 4. After the RCU grace period, kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory

Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths.

Fix: Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers.

Severity

7.8 (High)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-74583"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-21T17:16:44Z",
    "severity": "HIGH"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n    *after* the writer\u0027s reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n    fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers.",
  "id": "GHSA-qm4p-6qr9-f3w6",
  "modified": "2026-08-25T06:31:21Z",
  "published": "2026-08-21T18:34:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74583"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-74583

Vulnerability from csaf_microsoft - Published: 2026-08-23 01:03 - Updated: 2026-08-24 14:44

Summary

net/sched: cls_route: fix fastmap use-after-free on filter

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-74583

Affected products

Known affected 1 product

Product	Identifier	Version	Remediation
Unresolved product id: 17084-1		—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-74583 net/sched: cls_route: fix fastmap use-after-free on filter - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74583.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "net/sched: cls_route: fix fastmap use-after-free on filter",
    "tracking": {
      "current_release_date": "2026-08-24T14:44:01.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.239Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-74583",
      "initial_release_date": "2026-08-23T01:03:20.000Z",
      "revision_history": [
        {
          "date": "2026-08-23T01:03:20.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2026-08-24T14:44:01.000Z",
          "legacy_version": "2",
          "number": "2",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                "product": {
                  "name": "azl3 kernel 0:6.6.150.1-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "kernel"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 kernel 0:6.6.150.1-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74583",
      "notes": [
        {
          "category": "general",
          "text": "Linux",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-74583 net/sched: cls_route: fix fastmap use-after-free on filter - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74583.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-23T01:03:20.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        }
      ],
      "title": "net/sched: cls_route: fix fastmap use-after-free on filter"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-74583 (GCVE-0-2026-74583)

FKIE_CVE-2026-74583

GHSA-QM4P-6QR9-F3W6

MSRC_CVE-2026-74583

Tags

Sightings

Nomenclature