CVE-2026-64572: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64572 Overview

CVE-2026-64572 is a use-after-free vulnerability in the Linux kernel's IPv4 Forwarding Information Base (FIB) subsystem. The flaw exists in fib_table_insert() within net/ipv4/fib_trie.c, where a new fib_alias structure is published to the leaf's fa_list before FIB entry notifiers run. When a notifier rejects the route, the error path removes the alias and frees it immediately with kmem_cache_free(), while concurrent readers walking the list under RCU may still dereference the freed object. Triggering the condition requires CAP_NET_ADMIN and a registered FIB notifier that can reject a route, such as a netdevsim device with exhausted IPv4 FIB resources.

Critical Impact
A local attacker with CAP_NET_ADMIN can trigger a slab use-after-free in fib_table_lookup(), resulting in kernel memory corruption, denial of service, or potential privilege escalation.

Affected Products

Linux kernel — IPv4 FIB subsystem (net/ipv4/fib_trie.c)
Stable kernel branches referenced in commits 8150b53, b8d2ea7, cb8be31, d007056, f2f152e
Systems with netdevsim or other FIB notifier providers that can reject routes

Discovery Timeline

2026-08-05 - CVE-2026-64572 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-64572

Vulnerability Analysis

The defect resides in the FIB insertion logic for IPv4 route tables. fib_table_insert() calls fib_insert_alias() to link new_fa into the leaf's fa_list before invoking the FIB entry notifier chain. If any notifier returns an error, the function must roll back the partial insertion.

The error path calls fib_remove_alias(), which performs hlist_del_rcu(), and then immediately frees the alias via kmem_cache_free(). This ordering is unsafe because fib_table_lookup() traverses the same list while holding only rcu_read_lock(). A concurrent lookup that has already advanced to new_fa continues to read the object after it has been freed.

Kernel Address Sanitizer (KASAN) confirms the pattern as a slab-use-after-free in fib_table_lookup at net/ipv4/fib_trie.c:1601, on the ip_fib_alias slab cache (56 bytes). The upstream fix replaces the direct kmem_cache_free() call with alias_free_mem_rcu(), matching the deferred-free strategy already used by fib_table_delete().

Root Cause

The root cause is a violation of the RCU grace-period contract. Once a data structure is published to an RCU-protected list, it must be freed via kfree_rcu() or an equivalent callback so that in-flight readers can complete. The insert error path bypassed that requirement.

Attack Vector

Exploitation requires local access with CAP_NET_ADMIN in the initial user namespace and a FIB notifier configured to reject routes. A netdevsim instance with its IPv4 FIB resource limit exhausted satisfies this condition. The attacker races an IPv4 route insertion that will fail against a socket operation such as connect() on a UDP socket, which drives fib_table_lookup() through ip_route_output_key_hash_rcu().

Because no verified public exploit code is available for this issue, refer to the upstream commits listed in the Linux Kernel Commit 8150b53 and Linux Kernel Commit f2f152e references for the exact code paths involved.

Detection Methods for CVE-2026-64572

Indicators of Compromise

KASAN reports referencing slab-use-after-free in fib_table_lookup and the ip_fib_alias slab cache
Unexpected kernel oops or panic traces originating in fib_table_lookup, ip_route_output_key_hash_rcu, or __ip4_datagram_connect
Unprivileged workloads creating netdevsim devices or repeatedly inserting IPv4 routes that fail with resource-exhaustion errors

Detection Strategies

Enable KASAN on test and pre-production kernels to surface the use-after-free during fuzzing or regression runs
Audit auditd records for netlink route-add operations paired with EBUSY or ENOSPC return codes from processes holding CAP_NET_ADMIN
Monitor for kernel ring buffer entries containing BUG: KASAN or general protection fault referencing FIB functions

Monitoring Recommendations

Ship dmesg and /var/log/kern.log to a centralized logging platform and alert on FIB-related fault signatures
Track process capabilities and namespace creation events on multi-tenant hosts, especially containers granted CAP_NET_ADMIN
Correlate netdevsim usage and FIB resource-limit changes with subsequent kernel instability

How to Mitigate CVE-2026-64572

Immediate Actions Required

Apply the stable kernel updates that include the fix, referenced in commits 8150b53, b8d2ea7, cb8be31, d007056, and f2f152e
Restrict CAP_NET_ADMIN to trusted administrators and remove it from container workloads that do not require it
Disable or blacklist the netdevsim module on production systems where it is not required

Patch Information

The upstream fix changes the insert error path in fib_table_insert() to free new_fa through alias_free_mem_rcu() instead of kmem_cache_free(), ensuring RCU readers finish before the memory is reclaimed. Distribution vendors have backported the change across supported stable branches. See Linux Kernel Commit b8d2ea7, Linux Kernel Commit cb8be31, and Linux Kernel Commit d007056 for the backport series.

Workarounds

Blacklist netdevsim with install netdevsim /bin/true in /etc/modprobe.d/ to remove the primary trigger
Drop CAP_NET_ADMIN from container and service manifests using seccomp or capability bounding sets
Constrain unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 on distributions that expose the toggle

bash

# Configuration example
echo 'blacklist netdevsim' | sudo tee /etc/modprobe.d/blacklist-netdevsim.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
# Verify no processes hold CAP_NET_ADMIN unexpectedly
sudo getpcaps $(pgrep -d, -v '^1$') 2>/dev/null | grep cap_net_admin