CVE-2026-74398

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD

addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD

via addrconf_dad_end(), which drops ifp->lock on return. The lock

is re-acquired after net_info_ratelimited(). A concurrent

ipv6_del_addr() can take the lock in that window, set ifp->state

to DEAD and run list_del_rcu(&ifp->if_list).

addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad:

and schedules a new dad_work. The work calls ipv6_del_addr()

again, hitting the already-poisoned list entry:

general protection fault: 0000 [#1] SMP NOPTI

CPU: 4 PID: 217 Comm: kworker/4:1

Workqueue: ipv6_addrconf addrconf_dad_work

RIP: 0010:ipv6_del_addr+0xe9/0x280

RAX: dead000000000122

Call Trace:

addrconf_dad_stop+0x113/0x140

addrconf_dad_work+0x28c/0x430

process_one_work+0x1eb/0x3b0

worker_thread+0x4d/0x400

kthread+0x104/0x140

ret_from_fork+0x35/0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References