CVE-2026-74562

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nexthop: take nh->lock for f6i_list walks in replace check and notify

fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list

during an RTNL-serialized nexthop replace without holding nh->lock. IPv6

RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under

nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a

concurrent route delete that unlinks and frees a fib6_info:

BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799)

Read of size 4 at addr ffff888014607e64 by task exploit/143

rt6_fill_node.isra.0 (net/ipv6/route.c:5799)

fib6_rt_update (net/ipv6/route.c:6412)

__nexthop_replace_notify (net/ipv4/nexthop.c:2542)

rtm_new_nexthop (net/ipv4/nexthop.c:2554)

rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605)

Read of size 8 at addr ffff888014a7d068 by task

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References