{"id":"CVE-2026-74561","state":"PUBLISHED","title":"nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop\nreplace without holding nh->lock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh->lock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n  BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n  Read of size 8 at addr ffff888012953e18 by task exploit/146\n   nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n   replace_nexthop (net/ipv4/nexthop.c:2610)\n   rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route's sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock\naround it would invert the established tb6_lock -> nh->lock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above.","publishedAt":"2026-08-15T12:28:04.525Z","updatedAt":"2026-10-15T10:09:15.073Z","severity":{"score":8.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"081efd18326e353c6fbfdeff903a83edde953f72","status":"affected","lessThan":"f97fae992155b11da516a509c855ff9d0868b107","versionType":"git"},{"version":"081efd18326e353c6fbfdeff903a83edde953f72","status":"affected","lessThan":"44f53e4331a30fabc38a411fae7524341b618db3","versionType":"git"},{"version":"081efd18326e353c6fbfdeff903a83edde953f72","status":"affected","lessThan":"4787a6d2629b4e8c0b6bacab1f75c1660eca44d9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/nexthop.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/nexthop.c"]}],"references":["https://git.kernel.org/stable/c/f97fae992155b11da516a509c855ff9d0868b107","https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3","https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9"],"weaknesses":[],"ingestedAt":"2026-10-29T20:12:58.252Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/74xxx/CVE-2026-74561.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-74561","state":"PUBLISHED","datePublished":"2026-08-15T12:28:04.525Z","dateUpdated":"2026-10-15T10:09:15.073Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-08-15T05:44:03.916Z"},"containers":{"cna":{"title":"nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nnexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush\n\nnh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop\nreplace without holding nh->lock, racing the unlocked IPv6 route\nadd/delete that mutate the list under nh->lock and free fib6_info\nentries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):\n\n  BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n  Read of size 8 at addr ffff888012953e18 by task exploit/146\n   nh_rt_cache_flush (net/ipv4/nexthop.c:2243)\n   replace_nexthop (net/ipv4/nexthop.c:2610)\n   rtm_new_nexthop (net/ipv4/nexthop.c:3323)\n   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n\nUnlike the other f6i_list walks, this one bumps each route's sernum via\nfib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock\naround it would invert the established tb6_lock -> nh->lock order and\ndeadlock. As the only purpose is to invalidate cached dsts, bump the\nIPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead,\nmirroring the rt_cache_flush() already done for IPv4 just above."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"081efd18326e353c6fbfdeff903a83edde953f72","status":"affected","lessThan":"f97fae992155b11da516a509c855ff9d0868b107","versionType":"git"},{"version":"081efd18326e353c6fbfdeff903a83edde953f72","status":"affected","lessThan":"44f53e4331a30fabc38a411fae7524341b618db3","versionType":"git"},{"version":"081efd18326e353c6fbfdeff903a83edde953f72","status":"affected","lessThan":"4787a6d2629b4e8c0b6bacab1f75c1660eca44d9","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/nexthop.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.16","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.16","versionType":"semver"},{"version":"6.18.57","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.8","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/ipv4/nexthop.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f97fae992155b11da516a509c855ff9d0868b107"},{"url":"https://git.kernel.org/stable/c/44f53e4331a30fabc38a411fae7524341b618db3"},{"url":"https://git.kernel.org/stable/c/4787a6d2629b4e8c0b6bacab1f75c1660eca44d9"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The slab use-after-free is reached only via local RTNETLINK on AF_NETLINK sockets: RTM_NEWNEXTHOP with NLM_F_REPLACE drives replace_nexthop()->nh_rt_cache_flush(), racing concurrent RTM_NEWROUTE/RTM_DELROUTE IPv6 route changes; it is not triggered by remote packet processing.\nAC:L - The race is attacker-controlled: one thread replaces a nexthop under rtnl_net_lock while another concurrently adds/deletes IPv6 routes via unlocked inet6_rtm_newroute/inet6_rtm_delroute handlers; Microsoft reproduced reliable KASAN slab-use-after-free with this pattern.\nPR:L - rtnetlink_rcv_msg() requires CAP_NET_ADMIN via netlink_net_capable() for all non-GET handlers; unprivileged local users obtain this inside a user/network namespace (unshare -Urn), not only init-namespace root.\nUI:N - No victim interaction is required; exploitation is fully attacker-driven through coordinated local netlink nexthop replace and IPv6 route add/delete commands from attacker-controlled processes.\nS:C - A successful UAF from CAP_NET_ADMIN inside an unprivileged user/network namespace corrupts host kernel slab memory and can escape the namespace/container sandbox to compromise the host system, crossing the container-to-host security boundary.\nC:H - The unlocked nh->f6i_list walk dereferences freed fib6_info objects (KASAN read of size 8 at nh_rt_cache_flush), enabling arbitrary kernel memory disclosure via slab heap reuse of attacker-groomed objects.\nI:H - Beyond the UAF read, fib6_update_sernum_upto_root() writes fn_sernum through stale fib6_info/fib6_table pointers; slab UAF on fib6_info provides memory corruption primitives for arbitrary kernel writes and local privilege escalation.\nA:H - The confirmed KASAN slab-use-after-free in nh_rt_cache_flush during nexthop replace causes kernel oops/panic; UAF list walks are inherently crash-prone and can be triggered repeatedly for denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-10-15T10:09:15.073Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"6.18.57"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.1.8"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.16","versionEndExcluding":"7.2"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}}}}}