CVE-2026-74583

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_route: fix fastmap use-after-free on filter

The route4 classifier maintains a 16-slot fastmap cache that stores raw

struct route4_filter pointers indexed by (id, iif). The reader

(route4_classify) populates this cache via route4_set_fastmap() for every

classified packet that hits a filter. The writer (route4_delete,

route4_change) clears the cache via route4_reset_fastmap() before

RCU-deferred kfree of the filter.

This creates a UAF race:

1. Reader walks the RCU-protected bucket chain, finds filter f

2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()

3. Reader calls route4_set_fastmap() and writes f into the cache

*after* the writer's reset, caching a pointer about to be freed

4. After the RCU grace period, kfree(f) executes

5. Next classified packet on the same (id, iif) tuple hits the stale

fastmap entry and reads f->res from freed memory

Reproduced with an mdelay

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References