{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74581", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.918Z", "datePublished": "2026-08-21T16:31:54.683Z", "dateUpdated": "2026-08-21T16:31:54.683Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-21T16:31:54.683Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res->rt6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res->rt6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/fib6_rules.c"], "versions": [{"version": "209d35ee34e25f9668c404350a1c86d914c54ffa", "lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb", "status": "affected", "versionType": "git"}, {"version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383", "lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "9bad152c42b37499162367fe47867411e62fffa3", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937", "status": "affected", "versionType": "git"}, {"version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7", "status": "affected", "versionType": "git"}, {"version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29", "status": "affected", "versionType": "git"}, {"version": "5.10.84", "lessThan": "5.10.265", "status": "affected", "versionType": "semver"}, {"version": "5.15.7", "lessThan": "5.15.216", "status": "affected", "versionType": "semver"}, {"version": "5.4.164", "lessThan": "5.5", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv6/fib6_rules.c"], "versions": [{"version": "5.16", "status": "affected"}, {"version": "0", "lessThan": "5.16", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.265", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.216", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.183", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.151", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.103", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.44", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.8", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.84", "versionEndExcluding": "5.10.265"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.7", "versionEndExcluding": "5.15.216"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.1.183"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.6.151"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.12.103"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "6.18.44"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.1.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.16", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.164"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"}, {"url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"}, {"url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"}, {"url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"}, {"url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"}, {"url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"}, {"url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"}, {"url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"}], "title": "net: ipv6: clear suppressed fib6 rule result", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv6/fib6_rules.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb", "status": "affected", "version": "209d35ee34e25f9668c404350a1c86d914c54ffa", "versionType": "git"}, {"lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f", "status": "affected", "version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383", "versionType": "git"}, {"lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "9bad152c42b37499162367fe47867411e62fffa3", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7", "status": "affected", "version": "cdef485217d30382f3bf6448c54b4401648fe3f1", "versionType": "git"}, {"status": "affected", "version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29", "versionType": "git"}, {"lessThan": "5.10.265", "status": "affected", "version": "5.10.84", "versionType": "semver"}, {"lessThan": "5.15.216", "status": "affected", "version": "5.15.7", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.164", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv6/fib6_rules.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.16"}, {"lessThan": "5.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.265", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.216", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.183", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.151", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.103", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.44", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res->rt6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res->rt6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."}], "id": "CVE-2026-74581", "lastModified": "2026-08-21T17:16:44.363", "metrics": {}, "published": "2026-08-21T17:16:44.363", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer", "id": "2520980", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520980"}, "csaw": true, "cvss3": {"cvss3_base_score": "7.8", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-416", "details": ["A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6_rule_suppress(), when a route is suppressed and released via ip6_rt_put_flags(), the res->rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6_rule_lookup() returns the stale (freed) rt6_info to its caller. The subsequent dst_release() then operates on freed memory, hitting rcuref_put_slowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, prevent the `ipv6` kernel module from loading. Create a file named `/etc/modprobe.d/disable-ipv6.conf` with the following content:\n```\ninstall ipv6 /bin/true\nblacklist ipv6\n```\nAfter creating the file, regenerate the initramfs and reboot the system for the change to take effect. Applications or services that rely on the IPv6 protocol cannot use this mitigation and should prioritize applying the fix."}, "name": "CVE-2026-74581", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Will not fix", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74581\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74581\nhttps://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7"], "threat_severity": "Important"}