CVE-2026-74581net: ipv6: clear suppressed fib6 rule result
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | 209d35ee34e25f9668c404350a1c86d914c54ffa builds before 90c57310e266eb94e4a80d6b15a9ca131d2e82cb; 8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383 builds before 5d29b286c9de0b309e94b9ed083aa1a2f429434f; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 354db6243eca59e9d187ffbf8b7955b044ce84dc; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 9bad152c42b37499162367fe47867411e62fffa3; from cdef485217d30382f3bf6448c54b4401648fe3f1 before dc3ab04220667f254f4348572b2a0b3febff89fb; from cdef485217d30382f3bf6448c54b4401648fe3f1 before a341c091ca0bfae377747b1b59a3bd8ebe18a937; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 6aea62e433fe1b586202a5fee8b5807ce635e1d7; and 4 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb
- https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f
- https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc
- https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
- https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3
- https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb
- https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937
- https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.