CVE-2026-64572

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: free fib_alias with kfree_rcu() on insert error path

fib_table_insert() publishes new_fa into the leaf's fa_list with

fib_insert_alias() before calling the fib entry notifiers. When a

notifier fails, the error path removes new_fa with fib_remove_alias()

(hlist_del_rcu) and frees it right away with kmem_cache_free().

fib_table_lookup() walks that list under rcu_read_lock() only, so a

concurrent lookup that already reached new_fa keeps reading it after the

free:

BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)

Read of size 1 at addr ffff88810676d4eb by task exploit/297

Call Trace:

fib_table_lookup (net/ipv4/fib_trie.c:1601)

ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)

ip_route_output_key_hash (net/ipv4/route.c:2705)

__ip4_datagram_connect (net/ipv4/datagram.c:49)

udp_connect (net/ipv4/udp.c:2144)

__sys_connect (net/socket.c:2167)

__x64_sys_connect (net

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References