GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74583 (GCVE-0-2026-74583)

Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40
VLAI
Title
net/sched: cls_route: fix fastmap use-after-free on filter
Summary
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter. This creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed 4. After the RCU grace period, kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths. Fix: Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 7897198b26445b4009a057bda1986b94a99e5d5f (git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 820f083c294ad6d319c02a7d43294f2ed2565139 (git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 5ec9001be6d0eb527251125632ec8fe88278897f (git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < b969984b2bdc85d721ce4047cd270cd37ec705a2 (git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < a17f636c9330eac879822ce29f998e5abd1b72c1 (git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 0e7a8cf8895b06d07c7311f028eba16ad742b9bc (git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < ae9aff87025219005a2d16b4fe83d6f24643e50d (git)
Affected: 1109c00547fc66df45b9ff923544be4c1e1bec13 , < 47d7f7051253bdc02b1d245d87e38f16d31a74df (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.18
Unaffected: 0 , < 3.18 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "7897198b26445b4009a057bda1986b94a99e5d5f",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "820f083c294ad6d319c02a7d43294f2ed2565139",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "5ec9001be6d0eb527251125632ec8fe88278897f",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "b969984b2bdc85d721ce4047cd270cd37ec705a2",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "a17f636c9330eac879822ce29f998e5abd1b72c1",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "0e7a8cf8895b06d07c7311f028eba16ad742b9bc",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "ae9aff87025219005a2d16b4fe83d6f24643e50d",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            },
            {
              "lessThan": "47d7f7051253bdc02b1d245d87e38f16d31a74df",
              "status": "affected",
              "version": "1109c00547fc66df45b9ff923544be4c1e1bec13",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/sched/cls_route.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.18"
            },
            {
              "lessThan": "3.18",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.18",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/sched: cls_route: fix fastmap use-after-free on filter\n\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\nstruct route4_filter pointers indexed by (id, iif). The reader\n(route4_classify) populates this cache via route4_set_fastmap() for every\nclassified packet that hits a filter. The writer (route4_delete,\nroute4_change) clears the cache via route4_reset_fastmap() before\nRCU-deferred kfree of the filter.\n\nThis creates a UAF race:\n 1. Reader walks the RCU-protected bucket chain, finds filter f\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\n 3. Reader calls route4_set_fastmap() and writes f into the cache\n    *after* the writer\u0027s reset, caching a pointer about to be freed\n 4. After the RCU grace period, kfree(f) executes\n 5. Next classified packet on the same (id, iif) tuple hits the stale\n    fastmap entry and reads f-\u003eres from freed memory\n\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\nconcurrent add/delete stress test (provided by both zdi and Santosh).\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\npaths.\n\nFix:\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\nrepublishing by in-flight readers."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local rtnetlink RTM_NEWTFILTER/RTM_DELTFILTER (tc filter add/change/del route) through sendmsg\u2192rtnetlink_rcv_msg\u2192tc_new_tfilter/tc_del_tfilter\u2192route4_change/route4_delete; remote packets alone cannot trigger the filter-deletion side of the race.\nAC:L - The attacker controls both race sides\u2014concurrent route filter add/change/delete via netlink plus traffic through route4_classify on clsact/ingress/egress qdiscs; ZDI and independent reporter stress tests reproduced KASAN slab-use-after-free without uncontrollable prerequisites.\nPR:L - Non-GET rtnetlink handlers require netlink_net_capable(CAP_NET_ADMIN), evaluated against the target network namespace user_ns; an unprivileged local user obtains CAP_NET_ADMIN via user+network namespaces (unshare -Urn) and configures clsact with route filters.\nUI:N - No victim interaction is needed; the attacker configures the route classifier, drives concurrent filter churn, and generates matching traffic from their own processes.\nS:U - Impact is kernel memory corruption within the same kernel security boundary (local privilege escalation/DoS); it does not cross VM, hypervisor, or IOMMU boundaries.\nC:H - Slab use-after-free: a stale fastmap entry retains a freed route4_filter pointer and route4_classify dereferences f-\u003eres from freed kmalloc memory; KASAN confirmed slab-use-after-free, enabling arbitrary kernel read via heap reclaim/spray.\nI:H - UAF of the kmalloc route4_filter object allows attacker-controlled heap spraying to reclaim the freed slot and obtain write/control-flow hijacking primitives; memory corruption is exploitable beyond a simple crash.\nA:H - UAF on the fastmap hot path causes kernel oops/panic under concurrent filter churn; KASAN slab-use-after-free was confirmed during add/delete stress testing, providing reliable denial of service even without full exploitation."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:10.077Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f"
        },
        {
          "url": "https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139"
        },
        {
          "url": "https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f"
        },
        {
          "url": "https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2"
        },
        {
          "url": "https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d"
        },
        {
          "url": "https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df"
        }
      ],
      "title": "net/sched: cls_route: fix fastmap use-after-free on filter",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74583",
    "datePublished": "2026-08-21T16:31:55.886Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-25T05:40:10.077Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74583",
      "date": "2026-09-16",
      "epss": "0.00117",
      "percentile": "0.01886"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:44:12.000Z",
      "cve": "CVE-2026-74583",
      "id": "msrc_CVE-2026-74583",
      "initial_release_date": "2026-08-23T01:03:20.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "net/sched: cls_route: fix fastmap use-after-free on filter",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74583.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74583\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-21T17:16:44.643\",\"lastModified\":\"2026-08-25T06:18:32.033\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnet/sched: cls_route: fix fastmap use-after-free on filter\\n\\nThe route4 classifier maintains a 16-slot fastmap cache that stores raw\\nstruct route4_filter pointers indexed by (id, iif). The reader\\n(route4_classify) populates this cache via route4_set_fastmap() for every\\nclassified packet that hits a filter. The writer (route4_delete,\\nroute4_change) clears the cache via route4_reset_fastmap() before\\nRCU-deferred kfree of the filter.\\n\\nThis creates a UAF race:\\n 1. Reader walks the RCU-protected bucket chain, finds filter f\\n 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()\\n 3. Reader calls route4_set_fastmap() and writes f into the cache\\n    *after* the writer\u0027s reset, caching a pointer about to be freed\\n 4. After the RCU grace period, kfree(f) executes\\n 5. Next classified packet on the same (id, iif) tuple hits the stale\\n    fastmap entry and reads f-\u003eres from freed memory\\n\\nReproduced with an mdelay(100) accelerator in route4_set_fastmap() and a\\nconcurrent add/delete stress test (provided by both zdi and Santosh).\\nBoth triggered KASAN slab-use-after-free reports in the route4 fastmap\\npaths.\\n\\nFix:\\nIntroduce a per-filter boolean dying flag to suppress stale fastmap\\nrepublishing by in-flight readers.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/sched/cls_route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"7897198b26445b4009a057bda1986b94a99e5d5f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"820f083c294ad6d319c02a7d43294f2ed2565139\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"5ec9001be6d0eb527251125632ec8fe88278897f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"b969984b2bdc85d721ce4047cd270cd37ec705a2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"a17f636c9330eac879822ce29f998e5abd1b72c1\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"0e7a8cf8895b06d07c7311f028eba16ad742b9bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"ae9aff87025219005a2d16b4fe83d6f24643e50d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"1109c00547fc66df45b9ff923544be4c1e1bec13\",\"lessThan\":\"47d7f7051253bdc02b1d245d87e38f16d31a74df\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/sched/cls_route.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.18\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.18\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-26T10:59:45+00:00",
      "cve": "CVE-2026-74583",
      "id": "CVE-2026-74583",
      "initial_release_date": "2026-08-21T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net/sched: cls_route: fix fastmap use-after-free on filter",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74583.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:18:27Z",
      "cve": "CVE-2026-74583",
      "id": "CVE-2026-74583",
      "initial_release_date": "2026-08-22T00:52:31Z",
      "product_status:known_affected": "353",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74583",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74583.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.