CVE-2026-74630

Status: UPDATED  |  Advisory ID: CVE-2026-74630

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ipv6: prevent in6_dev_get() from resurrecting inet6_dev

in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally

increments its refcount. Device teardown can clear the pointer and drop

the last reference between these operations. The increment then

resurrects an object whose RCU free has already been queued, so callers

can use it after it is freed.

Use refcount_inc_not_zero() and return NULL when the object has already

reached zero. RCU keeps the memory accessible through the attempted

reference acquisition, and a successful increment pins the object for

the caller.

An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)

kernel reproduced the invalid reference acquisition as UID 1000:

refcount_t: addition on 0; use-after-free.

ip6_mc_source+0xef4/0x17e0

It was followed by the corresponding reference underflow in

ip6_mc_source(). The supplied trace from the same unpatched revision

additionally shows the access after the RCU read-side section ends:

BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0

Write of size 8 at addr ffff888015b50240 by task poc/1219

Bug found and triaged by OpenAI Security Research and

validated by Trail of Bits. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References