CVE-2026-74656: Linux Kernel Use-After-Free Vulnerability

CVE-2026-74656 Overview

CVE-2026-74656 is a use-after-free vulnerability in the Linux kernel's IPv4 networking stack. The flaw resides in the fib_nhc_update_mtu() function, which walks the nexthop exception table without proper synchronization against concurrent Path MTU (PMTU) exception updates. A local attacker can trigger the race by inducing MTU changes on a network device while PMTU exceptions are being updated on another CPU, leading to memory corruption in kernel space.

Critical Impact
Local attackers with the ability to trigger network device MTU changes can exploit this race condition to cause kernel memory corruption, potentially leading to privilege escalation, denial of service, or arbitrary kernel code execution.

Affected Products

Linux kernel (upstream) — IPv4 FIB nexthop exception handling code
Linux distributions shipping affected stable kernel branches prior to the fix commits
Systems using IPv4 routing with PMTU discovery enabled

Discovery Timeline

2026-08-22 - CVE-2026-74656 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74656

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] triggered by insufficient locking in the IPv4 FIB (Forwarding Information Base) nexthop exception table walk. The fib_nhc_update_mtu() function iterates over cached nexthop exceptions to propagate MTU changes across affected routes. The walk is performed while holding the RTNL (RouTing NetLink) lock, but RTNL does not serialize this walk against updates to PMTU exceptions performed by update_or_create_fnhe().

Internally, the walk uses rcu_dereference_protected() with a constant true condition, effectively bypassing lockdep enforcement. It does not acquire fnhe_lock, which is the writer lock protecting individual FNHE (FIB Nexthop Exception) entries. The KASAN (Kernel Address SANitizer) report demonstrates the resulting slab-use-after-free during a call chain from dev_set_mtu() through netif_set_mtu_ext(), fib_netdev_event(), fib_sync_mtu(), and finally fib_nhc_update_mtu().

Root Cause

The root cause is a missing lock and an incorrect synchronization assumption. The reader in fib_nhc_update_mtu() assumes RTNL provides mutual exclusion, but PMTU exception writers such as fnhe_remove_oldest() operate under fnhe_lock and can unlink and kfree_rcu() an entry concurrently. After a quiescent state, the reader dereferences a pointer to a freed slab object. In addition, the paired fields fnhe_pmtu and fnhe_mtu_locked can be read in a torn state because writers serialize the pair only under fnhe_lock.

Attack Vector

Exploitation is local. An attacker with the ability to trigger MTU changes on a network interface, combined with the ability to induce PMTU exception churn, can race the two code paths to free and then dereference an FNHE object. On CPU 0, fib_nhc_update_mtu() loads an FNHE pointer; on CPU 1, update_or_create_fnhe() acquires fnhe_lock, calls fnhe_remove_oldest(), unlinks the entry, and schedules it for RCU reclamation. After the grace period elapses, the CPU 0 path dereferences the freed memory. The fix rewalks the table under RCU and acquires fnhe_lock only while updating each exception.

Verified code examples were not available at publication. See the upstream Linux kernel commits referenced below for the full patch series.

Detection Methods for CVE-2026-74656

Indicators of Compromise

Unexpected kernel oops or panic messages referencing fib_nhc_update_mtu, fib_sync_mtu, or fib_netdev_event in dmesg or /var/log/kern.log.
KASAN slab-use-after-free reports pointing at the IPv4 FIB nexthop exception code path.
Repeated ip link set dev <iface> mtu <value> operations from non-administrative sessions correlated with network stack instability.

Detection Strategies

Enable KASAN on test and pre-production kernels to surface use-after-free conditions in the FIB nexthop code paths.
Audit kernel version inventory against the upstream fix commits (5a28a4b2, 63996ffc, bc5bde9c, dfe388da, e00f7d2b, e1e602d6, ed503eaa, fd39e711) to identify unpatched hosts.
Correlate kernel crash telemetry with local user activity that changes interface MTU or generates high PMTU exception churn.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized SIEM or data lake for correlation across hosts.
Alert on unprivileged processes invoking ioctl(SIOCSIFMTU) or netlink RTM_NEWLINK with MTU changes, which is unusual outside of administrative workflows.
Track auditd events for interface configuration changes on production servers, particularly containers with CAP_NET_ADMIN.

How to Mitigate CVE-2026-74656

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 5a28a4b2, 63996ffc, bc5bde9c, dfe388da, e00f7d2b, e1e602d6, ed503eaa, and fd39e711, or upgrade to a stable release that includes them.
Inventory all Linux hosts running IPv4 routing workloads, including containers and virtualization hosts, and prioritize kernel updates on multi-tenant systems.
Review which local users and workloads hold CAP_NET_ADMIN and remove the capability where it is not required.

Patch Information

The fix rewalks the nexthop exception table under RCU and acquires fnhe_lock only while updating each exception. RCU keeps the current entry alive during the walk, while the short critical section serializes the paired fnhe_pmtu and fnhe_mtu_locked fields. See the Kernel Commit 5a28a4b, Kernel Commit 63996ffc, Kernel Commit bc5bde9c, Kernel Commit dfe388da, Kernel Commit e00f7d2b, Kernel Commit e1e602d6, Kernel Commit ed503eaa, and Kernel Commit fd39e711.

Workarounds

Restrict CAP_NET_ADMIN on shared hosts and container workloads to prevent unprivileged users from changing interface MTU.
Disable unprivileged user namespaces where operational policy permits, reducing local access to network administration primitives.
Reduce PMTU exception churn where possible by ensuring MTU consistency across paths, lowering the practical race window on unpatched hosts.