CVE-2026-74656

Status: UPDATED  |  Advisory ID: CVE-2026-74656

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fix use-after-free in fib_nhc_update_mtu()

fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but

RTNL does not serialize this walk with PMTU exception updates. The walk

uses rcu_dereference_protected() with a constant true condition without

holding fnhe_lock.

The following interleaving can therefore occur:

CPU 0 CPU 1

fib_nhc_update_mtu() update_or_create_fnhe()

load fnhe spin_lock_bh(&fnhe_lock)

fnhe_remove_oldest()

unlink fnhe

kfree_rcu(fnhe, rcu)

<quiescent state>

access fnhe after grace period

KASAN reported:

BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410

Read of size 8 at addr ffff888107d49000 by task poc/90

Call Trace:

fib_nhc_update_mtu+0x3df/0x410

fib_sync_mtu+0x7a/0xd0

fib_netdev_event+0x229/0x3f0

netif_set_mtu_ext+0x33a/0x570

dev_set_mtu+0x88/0x120

The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a

pair and other writers serialize them with fnhe_lock. RCU alone prevents

reclamation, but would still allow concurrent writers to leave a mixed

pair.

Walk the table under RCU and acquire fnhe_lock only while updating each

exception. RCU keeps the current entry alive while the short critical

section serializes its paired PMTU fields. This avoids holding the global

lock while scanning all 2048 buckets for every nexthop. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References