CVE-2026-74656 - Vulnerability Details

- ipv4: fix use-after-free in fib_nhc_update_mtu()

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fix use-after-free in fib_nhc_update_mtu()

fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
RTNL does not serialize this walk with PMTU exception updates. The walk
uses rcu_dereference_protected() with a constant true condition without
holding fnhe_lock.

The following interleaving can therefore occur:

CPU 0 CPU 1
fib_nhc_update_mtu() update_or_create_fnhe()
load fnhe spin_lock_bh(&fnhe_lock)
fnhe_remove_oldest()
unlink fnhe
kfree_rcu(fnhe, rcu)
<quiescent state>
access fnhe after grace period

KASAN reported:

BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410
Read of size 8 at addr ffff888107d49000 by task poc/90
Call Trace:
fib_nhc_update_mtu+0x3df/0x410
fib_sync_mtu+0x7a/0xd0
fib_netdev_event+0x229/0x3f0
netif_set_mtu_ext+0x33a/0x570
dev_set_mtu+0x88/0x120

The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a
pair and other writers serialize them with fnhe_lock. RCU alone prevents
reclamation, but would still allow concurrent writers to leave a mixed
pair.

Walk the table under RCU and acquire fnhe_lock only while updating each
exception. RCU keeps the current entry alive while the short critical
section serializes its paired PMTU fields. This avoids holding the global
lock while scanning all 2048 buckets for every nexthop.

Published: 2026-08-22

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A race condition can occur in the Linux kernel’s IPv4 nexthop handling when an MTU update intersects with a topology change. The kernel walks the nexthop exception table without holding the required lock, and uses RCU without proper protection for the entry. If the entry is freed while still being referenced, the kernel can read freed memory, resulting in a use‑after‑free vulnerability that may expose kernel data.

Affected Systems

Any Linux kernel that includes the IPv4 nexthop code and has not yet incorporated the commit that applies the fix is affected. The specific kernel versions are not listed; all builds before the fix commit are potentially vulnerable.

Risk and Exploitability

The flaw scores 7.8 on CVSS, indicating substantial severity. EPSS is reported as < 1%, reflecting a very low estimated exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require a carefully timed interleaving of network configuration changes that update MTU values and modify the nexthop table, a scenario that is not actively exploited at the time of this analysis.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< fd39e711866498ae94fcf9acf6f422a4f045b681
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< e1e602d6b22d5cb1641c4459c487eb18bf569e0a
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< e00f7d2b5f2540a3415a229c982af7a25ff6362e
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< dfe388da13aa784851e5ebbea90afbb099075761
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< 5a28a4b22dde92f9d293b94236314b8d6181dc4a
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< 63996ffc594d128ccec8fc0983f91effd2d3adc4
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< ed503eaad62f20cdd5122d7c3078a648a99c8f16
`af7d6cce53694a88d6a1bb60c9a239a6a5144459`	affected	< bc5bde9ce3cc36502839dfe98e068f7303a50982
`b427832009b97a3ee412ef643a80b15372a7754d`	affected	—
`2b7e4c735933be79882aba2bed9afa789e03c62f`	affected	—
`8d59c3a6376bbc6dd3f7303968a719ffba75a4f1`	affected	—
`9b4869cf385aa16f89c0f019eed4ec4e36aa441c`	affected	—
`ff34695ced21e2dfa04d0fa1c5f6c35011fa8117`	affected	—
`3.16.62`	affected	< 3.17
`4.4.162`	affected	< 4.5
`4.9.134`	affected	< 4.10
`4.14.77`	affected	< 4.15
`4.18.15`	affected	< 4.19

Linux

affected

Version	Status	Constraints
`4.19`	affected	—
`0`	unaffected	< 4.19
`5.10.265`	unaffected	≤ 5.10.*
`5.15.216`	unaffected	≤ 5.15.*
`6.1.183`	unaffected	≤ 6.1.*
`6.6.152`	unaffected	≤ 6.6.*
`6.12.104`	unaffected	≤ 6.12.*
`6.18.45`	unaffected	≤ 6.18.*
`7.1.9`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,fd39e711866498ae94fcf9acf6f422a4f045b681)`	affected	code_commit	—
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,e1e602d6b22d5cb1641c4459c487eb18bf569e0a)`	affected	code_commit	—
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,e00f7d2b5f2540a3415a229c982af7a25ff6362e)`	affected	code_commit	—
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,dfe388da13aa784851e5ebbea90afbb099075761)`	affected	code_commit	—
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,5a28a4b22dde92f9d293b94236314b8d6181dc4a)`	affected	code_commit	—
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,63996ffc594d128ccec8fc0983f91effd2d3adc4)`	affected	code_commit	—
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,ed503eaad62f20cdd5122d7c3078a648a99c8f16)`	affected	code_commit	—
`[af7d6cce53694a88d6a1bb60c9a239a6a5144459,bc5bde9ce3cc36502839dfe98e068f7303a50982)`	affected	code_commit	—
`b427832009b97a3ee412ef643a80b15372a7754d`	affected	code_commit	—
`2b7e4c735933be79882aba2bed9afa789e03c62f`	affected	code_commit	—
`8d59c3a6376bbc6dd3f7303968a719ffba75a4f1`	affected	code_commit	—
`9b4869cf385aa16f89c0f019eed4ec4e36aa441c`	affected	code_commit	—
`ff34695ced21e2dfa04d0fa1c5f6c35011fa8117`	affected	code_commit	—
`[3.16.62,3.17)`	affected	semver	—
`[4.4.162,4.5)`	affected	semver	—
`[4.9.134,4.10)`	affected	semver	—
`[4.14.77,4.15)`	affected	semver	—
`[4.18.15,4.19)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.19`	affected	semver	—
`[0,4.19)`	unaffected	semver	—
`[5.10.265,5.11.0)`	unaffected	semver	—
`[5.15.216,5.16.0)`	unaffected	semver	—
`[6.1.183,6.2.0)`	unaffected	semver	—
`[6.6.152,6.7.0)`	unaffected	semver	—
`[6.12.104,6.13.0)`	unaffected	semver	—
`[6.18.45,6.19.0)`	unaffected	semver	—
`[7.1.9,7.2.0)`	unaffected	semver	—
`[7.2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the system to a kernel version that includes the commit that fixes fib_nhc_update_mtu().
If an immediate kernel upgrade is not possible, restrict or disable MTU modification operations during the window that can trigger the race condition to reduce the opportunity for exploitation.
If the package manager does not provide an updated kernel swiftly, manually apply the patch from the kernel source and recompile your kernel to include the fix.

Generated by OpenCVE AI on August 25, 2026 at 08:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4777-1	linux security update
Debian DSA	DSA-6466-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5a28a4b22dde92f9d293b94236314b8d6181dc4a
https://git.kernel.org/stable/c/63996ffc594d128ccec8fc0983f91effd2d3adc4
https://git.kernel.org/stable/c/bc5bde9ce3cc36502839dfe98e068f7303a50982
https://git.kernel.org/stable/c/dfe388da13aa784851e5ebbea90afbb099075761
https://git.kernel.org/stable/c/e00f7d2b5f2540a3415a229c982af7a25ff6362e
https://git.kernel.org/stable/c/e1e602d6b22d5cb1641c4459c487eb18bf569e0a
https://git.kernel.org/stable/c/ed503eaad62f20cdd5122d7c3078a648a99c8f16
https://git.kernel.org/stable/c/fd39e711866498ae94fcf9acf6f422a4f045b681
https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74656-f697@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-74656
https://www.cve.org/CVERecord?id=CVE-2026-74656

History

Tue, 25 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Mon, 24 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Mon, 24 Aug 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-367
References		https://lore.kernel.org/linux-cve-announce/2026082226-CVE-2026-74656-f697@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-74656 https://www.cve.org/CVERecord?id=CVE-2026-74656
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 22 Aug 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Sat, 22 Aug 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib_nhc_update_mtu() fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereference_protected() with a constant true condition without holding fnhe_lock. The following interleaving can therefore occur: CPU 0 CPU 1 fib_nhc_update_mtu() update_or_create_fnhe() load fnhe spin_lock_bh(&fnhe_lock) fnhe_remove_oldest() unlink fnhe kfree_rcu(fnhe, rcu) <quiescent state> access fnhe after grace period KASAN reported: BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410 Read of size 8 at addr ffff888107d49000 by task poc/90 Call Trace: fib_nhc_update_mtu+0x3df/0x410 fib_sync_mtu+0x7a/0xd0 fib_netdev_event+0x229/0x3f0 netif_set_mtu_ext+0x33a/0x570 dev_set_mtu+0x88/0x120 The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a pair and other writers serialize them with fnhe_lock. RCU alone prevents reclamation, but would still allow concurrent writers to leave a mixed pair. Walk the table under RCU and acquire fnhe_lock only while updating each exception. RCU keeps the current entry alive while the short critical section serializes its paired PMTU fields. This avoids holding the global lock while scanning all 2048 buckets for every nexthop.
Title		ipv4: fix use-after-free in fib_nhc_update_mtu()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/5a28a4b22dde92f9d293b94236314b8d6181dc4a https://git.kernel.org/stable/c/63996ffc594d128ccec8fc0983f91effd2d3adc4 https://git.kernel.org/stable/c/bc5bde9ce3cc36502839dfe98e068f7303a50982 https://git.kernel.org/stable/c/dfe388da13aa784851e5ebbea90afbb099075761 https://git.kernel.org/stable/c/e00f7d2b5f2540a3415a229c982af7a25ff6362e https://git.kernel.org/stable/c/e1e602d6b22d5cb1641c4459c487eb18bf569e0a https://git.kernel.org/stable/c/ed503eaad62f20cdd5122d7c3078a648a99c8f16 https://git.kernel.org/stable/c/fd39e711866498ae94fcf9acf6f422a4f045b681

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-22T15:32:30.729Z

Updated: 2026-08-25T05:41:13.058Z

Reserved: 2026-08-15T05:44:03.923Z

Link: CVE-2026-74656

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-22T16:16:39.177

Modified: 2026-08-25T06:18:46.560

Link: CVE-2026-74656

Redhat

Severity : Moderate

Publid Date: 2026-08-22T00:00:00Z

Links: CVE-2026-74656 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-25T08:30:04Z

Weaknesses

CWE-367
Time-of-check Time-of-use (TOCTOU) Race Condition

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object