CVE-2026-64572: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-64572 is a use-after-free vulnerability in the Linux kernel's IPv4 Forwarding Information Base (FIB) routing table implementation. It affects Linux kernel versions from 5.6 up to (but not including) the fixed stable releases: 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, and 7.1.6. The vulnerability was published on August 5, 2026, with patches available across multiple stable branches. It carries a CVSS v3.1 base score of 4.7 (Medium) (GitHub Advisory, Microsoft MSRC).

The root cause is an expired pointer dereference (CWE-825) in fib_table_insert() within net/ipv4/fib_trie.c. The function publishes a new fib_alias entry (new_fa) into the routing table's fa_list via fib_insert_alias() before invoking FIB entry notifiers. If a notifier fails, the error path removes new_fa using hlist_del_rcu() and immediately frees it with kmem_cache_free() — without waiting for any concurrent RCU readers to finish. Because fib_table_lookup() traverses the same list under rcu_read_lock() only, a concurrent lookup that has already obtained a pointer to new_fa continues reading freed memory, triggering a KASAN-detected slab-use-after-free. Exploitation requires CAP_NET_ADMIN and a registered FIB notifier that can reject a route insertion, achievable via a netdevsim device with exhausted IPv4 FIB resources (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation causes a kernel slab-use-after-free condition, primarily resulting in a system crash (denial of service). There is a limited confidentiality impact, as the freed kernel memory from the ip_fib_alias cache (56-byte objects) may be read by a concurrent lookup thread. Integrity is not directly affected. The vulnerability is locally scoped and does not enable remote code execution or lateral movement, but a system crash on a network-critical host could disrupt routing and availability for dependent services (GitHub Advisory, Microsoft MSRC).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with CAP_NET_ADMIN privileges and a specific race condition between route insertion failure and concurrent routing lookups, making opportunistic exploitation unlikely. The EPSS score is approximately 0.186%, reflecting low probability of near-term exploitation (GitHub Advisory, Red Hat CVE).

1. Gain CAP_NET_ADMIN: Obtain a local session with CAP_NET_ADMIN capability (e.g., as root or via a privileged container/namespace).
2. Set up a netdevsim device: Create a netdevsim network device and configure it to register a FIB notifier that will reject route insertions once IPv4 FIB resources are exhausted.
3. Exhaust FIB resources: Insert routes into the netdevsim device until its IPv4 FIB resource limit is reached, ensuring the next route insertion will trigger a notifier failure.
4. Trigger the race condition: Simultaneously initiate a route insertion (e.g., via ip route add) that will fail at the notifier stage, while running concurrent UDP connect() calls or other operations that invoke fib_table_lookup() on the same routing table.
5. Achieve use-after-free: The error path in fib_table_insert() frees new_fa via kmem_cache_free() while a concurrent fib_table_lookup() under rcu_read_lock() still holds a pointer to it, resulting in a slab-use-after-free read and potential kernel crash (GitHub Advisory).

• Logs: Kernel logs (dmesg / /var/log/kern.log) containing BUG: KASAN: slab-use-after-free in fib_table_lookup with references to net/ipv4/fib_trie.c:1601.
• Logs: Kernel panic or oops messages with call traces involving fib_table_lookup, ip_route_output_key_hash_rcu, __ip4_datagram_connect, udp_connect, and __sys_connect.
• Process: Processes named exploit or similar with unusual UDP connect() activity appearing in kernel stack traces alongside routing table operations.
• System: Unexpected system crashes or reboots on hosts running Linux kernel versions between 5.6 and the patched stable releases, particularly on systems with netdevsim devices or custom FIB notifiers configured.

Update the Linux kernel to a patched stable version: 5.10.265, 5.15.216, 6.1.183, 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2+. The fix replaces the immediate kmem_cache_free() call on the error path with alias_free_mem_rcu() (RCU-safe deferred deallocation), consistent with how fib_table_delete() already handles fib_alias removal. As a workaround, restrict CAP_NET_ADMIN to trusted users and processes only, and avoid deploying netdevsim devices in production environments where FIB resource exhaustion could be triggered (GitHub Advisory, Red Hat Bugzilla, Red Hat CVE).