CVE-2026-74581: Linux Kernel IPv6 Use-After-Free Vulnerability

CVE-2026-74581 Overview

CVE-2026-74581 is a use-after-free vulnerability in the Linux kernel's IPv6 routing subsystem. The flaw resides in fib6_rule_suppress(), which drops a suppressed route via ip6_rt_put_flags() but leaves res->rt6 pointing at the released rt6_info structure. When no subsequent rule supplies a replacement, fib6_rule_lookup() returns the stale destination to its caller. A suppressing FIB rule can therefore leak a released route back to rt6_lookup(), and the next dst_release() call triggers rcuref_put_slowpath() on freed memory.

Critical Impact
Remote, unauthenticated attackers may trigger kernel memory corruption in the IPv6 stack, leading to denial of service or potential privilege escalation on Linux systems using FIB6 suppress rules.

Affected Products

Linux kernel (IPv6 networking subsystem)
Systems configured with IPv6 FIB rule suppression
Distributions shipping vulnerable stable kernel branches referenced by the fix commits

Discovery Timeline

2026-08-21 - CVE-2026-74581 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74581

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the IPv6 Forwarding Information Base (FIB) rule engine. Linux supports policy routing through FIB rules that can match, redirect, or suppress route lookups. When a rule matches but its selected route fails suppression criteria such as prefix length or output interface, the kernel is expected to discard that route and continue rule evaluation.

In the vulnerable code path, fib6_rule_suppress() releases the reference on the candidate route using ip6_rt_put_flags(). However, it does not clear the res->rt6 pointer in the lookup result structure. If no later rule installs a replacement route, fib6_rule_lookup() observes the still-populated res.rt6 field and returns the freed pointer to its caller.

The returned destination then re-enters normal packet processing. When the caller eventually invokes dst_release(), the reference-count decrement runs against freed memory and reaches rcuref_put_slowpath(). This produces kernel memory corruption, refcount underflow warnings, or exploitable heap reuse.

Root Cause

The root cause is incomplete cleanup of the FIB lookup result structure after route suppression. The res->rt6 field retains a dangling pointer to the released rt6_info, violating the invariant that lookup results reflect only live, referenced routes.

Attack Vector

The vulnerability is reachable from the network attack surface. Any IPv6 packet processed against a suppressing FIB rule can trigger the stale pointer return. Exploitation requires the target system to have IPv6 FIB rules configured with suppression semantics, which is common in policy-routed hosts, routers, and containerized environments using per-namespace routing tables.

An attacker capable of sending IPv6 traffic that traverses the vulnerable rule chain can repeatedly trigger the freed-object reuse. Depending on kernel allocator behavior, this may collapse into a denial of service, memory disclosure, or a heap grooming primitive for local privilege escalation.

The vulnerability is described in prose only; no public proof-of-concept is available. See the referenced Kernel Commit 354db62 for the upstream fix.

Detection Methods for CVE-2026-74581

Indicators of Compromise

Kernel log entries referencing rcuref_put_slowpath, dst_release, or refcount warnings on rt6_info objects
KASAN or SLUB debug reports naming fib6_rule_lookup or fib6_rule_suppress in the freed-object stack trace
Unexpected IPv6 routing failures or kernel panics on hosts running policy routing with suppress_prefixlength or suppress_ifgroup rules

Detection Strategies

Inventory kernel versions across Linux endpoints and servers, comparing against the fix commits listed in the vendor advisory
Enumerate hosts with IPv6 FIB rules configured for suppression using ip -6 rule show and flag those running unpatched kernels
Correlate kernel oops or panic telemetry with IPv6 traffic spikes to identify triggering conditions

Monitoring Recommendations

Forward dmesg and /var/log/kern.log output to a central log platform and alert on refcount or use-after-free signatures
Monitor container and Kubernetes hosts, which frequently rely on policy routing and are more likely to hit the vulnerable path
Track IPv6 route churn and rule reconfiguration events that could be used to prime the vulnerable state

How to Mitigate CVE-2026-74581

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as distribution updates are available
Prioritize patching for routers, gateways, and multi-homed hosts that use IPv6 policy routing
Restart affected systems after patching to ensure the new kernel is loaded into memory

Patch Information

The fix clears res->rt6 when suppressing the route so that suppressed lookups fall through to the null destination instead of reusing the released one. Upstream commits addressing the issue include Kernel Commit 354db62, Kernel Commit 5d29b28, Kernel Commit 6aea62e, Kernel Commit 6d98c70, Kernel Commit 90c5731, Kernel Commit 9bad152, Kernel Commit a341c09, and Kernel Commit dc3ab04.

Workarounds

Remove IPv6 FIB suppression rules where operationally acceptable using ip -6 rule del for entries with suppress_prefixlength or suppress_ifgroup
Disable IPv6 on systems that do not require it by setting net.ipv6.conf.all.disable_ipv6=1 until a patched kernel is deployed
Restrict inbound IPv6 traffic at the network perimeter to reduce exposure to remote triggering

bash

# Inspect IPv6 policy routing rules for suppression entries
ip -6 rule show | grep -i suppress

# Example: remove a suppress_prefixlength rule (adjust to your environment)
# ip -6 rule del table main suppress_prefixlength 0

# Temporary mitigation: disable IPv6 until patched kernel is installed
sysctl -w net.ipv6.conf.all.disable_ipv6=1
sysctl -w net.ipv6.conf.default.disable_ipv6=1