CVE-2026-74630

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent in6_dev_get() from resurrecting inet6_dev

in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally

increments its refcount. Device teardown can clear the pointer and drop

the last reference between these operations. The increment then

resurrects an object whose RCU free has already been queued, so callers

can use it after it is freed.

Use refcount_inc_not_zero() and return NULL when the object has already

reached zero. RCU keeps the memory accessible through the attempted

reference acquisition, and a successful increment pins the object for

the caller.

An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)

kernel reproduced the invalid reference acquisition as UID 1000:

refcount_t: addition on 0; use-after-free.

ip6_mc_source+0xef4/0x17e0

It was followed by the corresponding reference underflow in

ip6_mc_source(). The supplied trace from the same unpatched revision

addition

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References