CVE-2026-74662: Linux Kernel Race Condition Vulnerability

CVE-2026-74662 Overview

CVE-2026-74662 is a race condition in the Linux kernel's IPv4/IPv6 fragment reassembly subsystem. The flaw resides in inet_frag_create(), which arms the fragment queue timer before publishing the queue into the fqdir rhashtable. When a namespace fragment timeout is set to zero or a negative value, the timer callback can fire before the queue becomes visible in the hash table. The callback then marks the queue complete, fails to remove a node that is not yet inserted, and drops an anticipated hash reference. The creation path subsequently publishes an already-completed queue without restoring that reference, leaving a stale hash node once the remaining reference is released.

Critical Impact
Remote, unauthenticated attackers can trigger the race by sending crafted IP fragments to a system with a zero or negative fragment timeout, corrupting kernel hash table state.

Affected Products

Linux kernel — mainline and stable branches prior to the fix commits referenced in the kernel git tree
Linux distributions shipping vulnerable stable kernels (see distribution advisories for specific rebuild versions)
Systems using IPv4 or IPv6 fragment reassembly with configurable namespace timeouts

Discovery Timeline

2026-08-22 - CVE-2026-74662 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-74662

Vulnerability Analysis

The defect is a time-of-check to time-of-use race between fragment queue creation and its timer callback. inet_frag_create() allocates a new fragment queue, arms frag_expire via mod_timer(), and only afterwards inserts the queue into the fqdir rhashtable. Under normal conditions the timer runs long after publication. When the per-namespace fragment timeout is zero or negative, however, the timer becomes eligible to run immediately.

If the timer fires before insertion, inet_frag_kill() executes on a queue that has no hash node yet. The kill routine flags the queue as complete and attempts rhashtable_remove_fast(), which cannot find the entry. It still decrements the reference count that would normally balance a successful removal. When the creator then publishes the queue, the hash table receives an already-completed entry without the balancing reference. Once the caller drops its own reference, a dangling hash node remains, backed by freed memory in subsequent lookups.

Root Cause

The root cause is incorrect ordering between two concurrent operations on a shared kernel object. The queue was made timer-reachable before it was hash-reachable, violating the invariant that inet_frag_kill() relies on to atomically remove and unreference an entry. This class of defect is a race condition (TOCTOU-adjacent) leading to use-after-free of a kernel hash node.

Attack Vector

A remote attacker sends IP fragments to a host whose network namespace has been configured with a fragment reassembly timeout of zero. The kernel calls inet_frag_create() for each new datagram identifier, and the immediate timer expiry races the hash insertion. Repeatedly triggering the condition destabilizes the fragment hash table and can lead to use-after-free of the freed queue node during later lookups.

The upstream fix reorders the operations: publish the queue into the rhashtable first, then arm the timer while holding the queue lock. Timer expiry now waits until the queue is visible, allowing inet_frag_kill() to remove the node and balance the reference. See the fix commits 08a04d7, 39c6c4b, 4ed0681, 653d7dd, 9281288, 9f904dd, d3ffb89, and f4e4dab.

Detection Methods for CVE-2026-74662

Indicators of Compromise

Kernel oops or panic traces referencing inet_frag_kill, inet_frag_create, frag_expire, or rhashtable_remove_fast
Unexpected kernel warnings tied to fragment queue reference count imbalance in dmesg
Namespace configurations where ipfrag_time or ip6frag_time sysctls are set to zero or negative values

Detection Strategies

Audit running kernel versions across the fleet and compare against the fixed stable releases referenced in the kernel git commits
Monitor for anomalous fragmented IP traffic patterns to hosts with permissive fragment reassembly configuration
Correlate kernel crash telemetry with network activity spikes involving fragmented datagrams

Monitoring Recommendations

Collect kernel logs centrally and alert on stack traces containing inet_frag_* symbols
Track sysctl values for net.ipv4.ipfrag_time and net.ipv6.ip6frag_time across namespaces and containers
Ingest host and network telemetry into a centralized analytics platform to correlate kernel faults with inbound fragmented traffic

How to Mitigate CVE-2026-74662

Immediate Actions Required

Apply the upstream Linux kernel fix or install vendor-supplied kernel updates that include the reorder patch
Reboot systems after patching to load the fixed kernel image
Inventory containers and network namespaces and remove any zero or negative fragment timeout overrides

Patch Information

The fix publishes the fragment queue into the fqdir rhashtable before arming the expiration timer, and arms the timer while holding the queue lock. This guarantees that frag_expire observes a hash-visible queue, so inet_frag_kill() can remove the node and balance the reference. Fixes are available in the mainline and stable trees; see the kernel git commits linked in the technical details section.

Workarounds

Ensure net.ipv4.ipfrag_time and net.ipv6.ip6frag_time are set to positive, non-zero values (the default 30 seconds is not vulnerable)
Restrict who can modify network sysctls inside containers and namespaces by tightening capabilities such as CAP_NET_ADMIN
Where fragmentation is not required, drop fragmented IP traffic at the network edge until patched kernels are deployed

bash

# Verify safe fragment timeout configuration
sysctl net.ipv4.ipfrag_time
sysctl net.ipv6.ip6frag_time

# Restore safe defaults if zero or negative
sysctl -w net.ipv4.ipfrag_time=30
sysctl -w net.ipv6.ip6frag_time=60