CVE-2026-74581

net: ipv6: clear suppressed fib6 rule result

Published Aug 21, 2026 CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: clear suppressed fib6 rule result

fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info.

If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().

Clear res->rt6 when suppressing the route so suppressed lookups fall
through to the null dst instead of reusing the released one.

Analysis

Technical impact

The vulnerability resides in the Linux kernel's IPv6 routing subsystem. A suppressed route is removed but its internal destination pointer is not cleared. If no new rule replaces it, a lookup later returns the stale pointer, allowing the kernel to dereference freed memory. This use‑after‑free can trigger a kernel panic or other unintended behavior, effectively denying service to the affected system.

Affected Systems

All Linux kernel configurations are potentially affected. The CVE does not list specific kernel releases; the issue exists in any build that contains the unpatched fib6_rule_suppress implementation prior to the applied change.

Risk and Exploitability

The CVSS score is 9.8, and the EPSS score is < 1%. The vulnerability is listed as not in CISA KEV, indicating no confirmed public exploits yet. The attack vector is not explicitly described, but since the flaw lies in the kernel IPv6 stack, it is inferred that a malicious actor could craft special IPv6 routing messages to trigger the bug and cause a crash. The lack of a public exploit does not eliminate risk, as local or privileged attackers could exploit it. The high potential impact combined with the absence of mitigation guidance suggests that the threat is significant if the system is exposed to externally controlled IPv6 traffic.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`209d35ee34e25f9668c404350a1c86d914c54ffa`	affected	< 90c57310e266eb94e4a80d6b15a9ca131d2e82cb
`8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383`	affected	< 5d29b286c9de0b309e94b9ed083aa1a2f429434f
`cdef485217d30382f3bf6448c54b4401648fe3f1`	affected	< 354db6243eca59e9d187ffbf8b7955b044ce84dc
`cdef485217d30382f3bf6448c54b4401648fe3f1`	affected	< 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
`cdef485217d30382f3bf6448c54b4401648fe3f1`	affected	< 9bad152c42b37499162367fe47867411e62fffa3
`cdef485217d30382f3bf6448c54b4401648fe3f1`	affected	< dc3ab04220667f254f4348572b2a0b3febff89fb
`cdef485217d30382f3bf6448c54b4401648fe3f1`	affected	< a341c091ca0bfae377747b1b59a3bd8ebe18a937
`cdef485217d30382f3bf6448c54b4401648fe3f1`	affected	< 6aea62e433fe1b586202a5fee8b5807ce635e1d7
`ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29`	affected	—
`5.10.84`	affected	< 5.10.265
`5.15.7`	affected	< 5.15.216
`5.4.164`	affected	< 5.5

Linux

affected

Version	Status	Constraints
`5.16`	affected	—
`0`	unaffected	< 5.16
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.151`	unaffected	≤ 6.6.*
`6.12.103`	unaffected	≤ 6.12.*
`6.18.44`	unaffected	≤ 6.18.*
`7.1.8`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[209d35ee34e25f9668c404350a1c86d914c54ffa,90c57310e266eb94e4a80d6b15a9ca131d2e82cb)`	affected	code_commit	—
`[8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383,5d29b286c9de0b309e94b9ed083aa1a2f429434f)`	affected	code_commit	—
`[cdef485217d30382f3bf6448c54b4401648fe3f1,354db6243eca59e9d187ffbf8b7955b044ce84dc)`	affected	code_commit	—
`[cdef485217d30382f3bf6448c54b4401648fe3f1,6d98c70fe0ba8c7708bfd5b2a5174d2086775daa)`	affected	code_commit	—
`[cdef485217d30382f3bf6448c54b4401648fe3f1,9bad152c42b37499162367fe47867411e62fffa3)`	affected	code_commit	—
`[cdef485217d30382f3bf6448c54b4401648fe3f1,dc3ab04220667f254f4348572b2a0b3febff89fb)`	affected	code_commit	—
`[cdef485217d30382f3bf6448c54b4401648fe3f1,a341c091ca0bfae377747b1b59a3bd8ebe18a937)`	affected	code_commit	—
`[cdef485217d30382f3bf6448c54b4401648fe3f1,6aea62e433fe1b586202a5fee8b5807ce635e1d7)`	affected	code_commit	—
`ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29`	affected	code_commit	—
`[5.10.84,5.10.265)`	affected	semver	—
`[5.15.7,5.15.216)`	affected	semver	—
`[5.4.164,5.5)`	affected	generic	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.16`	affected	generic	—
`[0,5.16)`	unaffected	generic	—
`[5.10.265,5.10.*]`	unaffected	generic	—
`[5.15.216,5.15.*]`	unaffected	generic	—
`[6.1.183,6.1.*]`	unaffected	generic	—
`[6.6.151,6.6.*]`	unaffected	generic	—
`[6.12.103,6.12.*]`	unaffected	generic	—
`[6.18.44,6.18.*]`	unaffected	generic	—
`[7.1.8,7.1.*]`	unaffected	generic	—
`[7.2,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the system to a kernel release that includes the patch from commit 354db6243eca59e9d187ffbf8b7955b044ce84dc
If a kernel upgrade is not immediately possible and IPv6 is not required, disable IPv6 networking for the affected host by setting the appropriate sysctl parameters or recompiling the kernel without IPv6 support
Monitor the kernel logs and crash dump inventory for signs of route lookup failures or abnormal kernel panics and apply remediation as soon as a patched kernel becomes available

Generated by OpenCVE AI on August 25, 2026 at 06:54 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DLA	DLA-4788-1	linux-6.12 security update
Debian DSA	DSA-6466-1	linux security update
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8875-2	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-9019-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9020-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9022-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9023-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9024-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9025-1	Linux kernel vulnerabilities
Ubuntu USN	USN-9026-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-9029-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-9039-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-9040-1	Linux kernel (Low Latency NVIDIA) vulnerabilities
Ubuntu USN	USN-9066-1	Linux kernel (HWE) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.421% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7
https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc
https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f
https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7
https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb
https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3
https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937
https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb
https://nvd.nist.gov/vuln/detail/CVE-2026-74581
https://www.cve.org/CVERecord?id=CVE-2026-74581

History

Oct 17, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Aug 25, 2026 5:45 AM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Aug 22, 2026 12:15 AM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7 https://nvd.nist.gov/vuln/detail/CVE-2026-74581 https://www.cve.org/CVERecord?id=CVE-2026-74581
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Important`

Aug 21, 2026 6:00 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Aug 21, 2026 4:45 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.
Title		net: ipv6: clear suppressed fib6 rule result
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7 https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3 https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937 https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb