CVE-2026-74289

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: Don't dump dying fib_info in fib_leaf_notify().

syzbot reported use-after-free in nsim_fib4_prepare_event(). [0]

The problem is that the following functions call fib_info_hold() /

refcount_inc() while dumping fib_info under RCU, which is unsafe.

* mlxsw_sp_router_fib4_event()

* rocker_router_fib_event()

* nsim_fib4_prepare_event()

refcount_inc_not_zero() must be used, but it would be too late

there.

Let's guarantee the lifetime of fib_info in fib_leaf_notify().

Note that IPv6 does not need the corresponding change since

fib6_table_dump() holds fib6_table.tb6_lock.

[0]:

refcount_t: addition on 0; use-after-free.

WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#0: kworker/u8:15/3420

Modules linked in:

CPU: 0 UID: 0 PID: 3420 Comm: kworker/u8:15 Not tainted syzkaller #0 PREEMPT_{RT,(full)}

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References