CVE-2026-74656

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fix use-after-free in fib_nhc_update_mtu()

fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but

RTNL does not serialize this walk with PMTU exception updates. The walk

uses rcu_dereference_protected() with a constant true condition without

holding fnhe_lock.

The following interleaving can therefore occur:

CPU 0 CPU 1

fib_nhc_update_mtu() update_or_create_fnhe()

load fnhe spin_lock_bh(&fnhe_lock)

fnhe_remove_oldest()

unlink fnhe

kfree_rcu(fnhe, rcu)

<quiescent state>

access fnhe after grace period

KASAN reported:

BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410

Read of size 8 at addr ffff888107d49000 by task poc/90

Call Trace:

fib_nhc_update_mtu+0x3df/0x410

fib

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References