CVE-2026-74630: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74630 Overview

CVE-2026-74630 is a use-after-free vulnerability in the Linux kernel's IPv6 subsystem. The flaw resides in in6_dev_get(), which reads dev->ip6_ptr under RCU and then unconditionally increments the object's refcount. Device teardown can clear the pointer and drop the last reference between these two operations. The subsequent increment resurrects an object whose RCU free has already been queued, allowing callers to use freed memory. An unprivileged local user (UID 1000) can trigger the condition through the IPv6 multicast socket path, producing KASAN slab-use-after-free reports and refcount warnings originating in ip6_mc_source().

Critical Impact
A local, low-privileged attacker can trigger a kernel use-after-free in inet6_dev, enabling denial of service or potential local privilege escalation.

Affected Products

Linux kernel (upstream) reproduced on revision 6f5156d7a31a (v7.2-rc3 development tree)
Stable branches receiving backports referenced by kernel.org commits 0e243671, 145812b6, 14e812ab, 1c206d46, 680fbd79, 785d908f, aedcfefd, and cc5bd568
IPv6-enabled Linux distributions relying on the vulnerable in6_dev_get() implementation

Discovery Timeline

2026-08-22 - CVE-2026-74630 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74630

Vulnerability Analysis

The vulnerability is a use-after-free in the IPv6 networking stack triggered by a race between in6_dev_get() and device teardown. RCU protection guarantees that memory remains addressable, but it does not prevent the refcount from reaching zero. When in6_dev_get() reads dev->ip6_ptr and then blindly calls refcount_inc(), the object may have already had its final reference dropped and its RCU free callback queued. The increment revives a dead object, and the caller proceeds to operate on memory that is scheduled for release.

Reproduction on the unpatched tree surfaces two signatures. The first is a refcount saturation warning: refcount_t: addition on 0; use-after-free originating from ip6_mc_source+0xef4/0x17e0. The second is a KASAN report: BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0, indicating access after the RCU read-side critical section terminates. A subsequent reference underflow in ip6_mc_source() confirms the object's lifecycle has already ended.

Root Cause

The root cause is an unconditional refcount_inc() on an object whose refcount can reach zero concurrently. RCU keeps the memory readable, but object resurrection is not permitted once the final put executes. The correct primitive is refcount_inc_not_zero(), which fails safely when the counter has already dropped to zero. Returning NULL in that case forces callers to handle the teardown race explicitly.

Attack Vector

Exploitation requires local access with unprivileged user credentials. The reproducer was executed as UID 1000 using the IPv6 multicast source-list interface via ip6_mc_source(). An attacker races socket operations against network device teardown to obtain a reference to a freed inet6_dev structure. Subsequent use of the resurrected object leads to memory corruption in kernel context, which can be leveraged for denial of service or privilege escalation depending on heap state.

See the upstream fix commit 0e243671 and companion commit cc5bd568 for the exact code change replacing refcount_inc() with refcount_inc_not_zero().

Detection Methods for CVE-2026-74630

Indicators of Compromise

Kernel log entries containing refcount_t: addition on 0; use-after-free with a stack trace referencing ip6_mc_source
KASAN reports of the form BUG: KASAN: slab-use-after-free in mutex_lock triggered by network socket activity
Unexpected kernel oops or panic in the IPv6 multicast path following network interface removal or teardown
Local processes making repeated MCAST_JOIN_SOURCE_GROUP or MCAST_LEAVE_SOURCE_GROUP socket calls under setsockopt() on IPv6 sockets

Detection Strategies

Enable KASAN in test and staging kernels to surface slab-use-after-free events tied to inet6_dev structures.
Collect and forward dmesg and /var/log/kern.log entries to a central SIEM to alert on refcount warnings and KASAN reports.
Baseline normal IPv6 multicast socket usage per host and flag processes that issue high-volume setsockopt() calls against short-lived network namespaces or interfaces.

Monitoring Recommendations

Monitor kernel ring buffer output for refcount_t warnings and KASAN diagnostics with automated log ingestion.
Track container and network namespace churn on multi-tenant hosts; teardown races are more likely under aggressive namespace lifecycles.
Correlate unprivileged process activity invoking IPv6 socket options with concurrent interface state changes reported by rtnetlink.

How to Mitigate CVE-2026-74630

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by the fix commits and rebuild or install a patched kernel package from your distribution.
Restrict local shell access on multi-tenant systems until patched kernels are deployed, since exploitation requires local code execution.
Prioritize patching hosts that run untrusted workloads such as container platforms, CI runners, and shared build servers.

Patch Information

The fix replaces the unconditional refcount_inc() in in6_dev_get() with refcount_inc_not_zero() and returns NULL when the object has already reached zero. This blocks resurrection of an inet6_dev whose RCU free has been queued. Distribution-shipped kernels should incorporate one or more of the following commits: 0e243671, 145812b6, 14e812ab, 1c206d46, 680fbd79, 785d908f, aedcfefd, and cc5bd568.

Workarounds

Disable IPv6 where operationally acceptable by setting net.ipv6.conf.all.disable_ipv6=1 and net.ipv6.conf.default.disable_ipv6=1 via sysctl to eliminate the vulnerable code path.
Constrain untrusted workloads with seccomp filters that deny setsockopt() on IPv6 multicast source-list options.
Reduce local attack surface by enforcing least privilege on interactive user accounts and disallowing unprivileged user namespaces where feasible.

bash

# Configuration example: temporarily disable IPv6 until a patched kernel is deployed
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
sudo sysctl -w net.ipv6.conf.default.disable_ipv6=1

# Persist across reboot
echo 'net.ipv6.conf.all.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2026-74630.conf
echo 'net.ipv6.conf.default.disable_ipv6=1' | sudo tee -a /etc/sysctl.d/99-cve-2026-74630.conf

# Verify kernel version after patching
uname -r