CVE-2026-74562: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74562 is a race condition (use-after-free) vulnerability in the Linux kernel's IPv6 nexthop handling code. Specifically, fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace operation without holding nh->lock, while concurrent IPv6 route operations (RTM_NEWROUTE/RTM_DELROUTE) mutate that list under nh->lock, leading to use-after-free conditions. The vulnerability affects Linux kernel version 6.16 up to (but not including) the fix commits; versions prior to 6.16 and versions 7.1.8+ are unaffected. It was published on August 15, 2026, and no CVSS score has been formally assigned by NVD at this time; Feedly estimates it as Medium severity with an EPSS score of 0.0 (Github Advisory, Feedly).

The root cause is a missing lock acquisition (CWE — no formal CWE assigned yet) constituting a classic TOCTOU/race condition: fib6_check_nh_list() and __nexthop_replace_notify() in net/ipv4/nexthop.c iterate over nh->f6i_list without holding nh->lock, while IPv6 route add/delete operations (fib6_add_rt2node_nh(), fib6_purge_rt()) concurrently modify the same list under nh->lock. This race allows a concurrent route delete to unlink and free a fib6_info structure mid-walk, resulting in KASAN-detected slab-use-after-free reads (4-byte read in rt6_fill_node and 8-byte read in fib6_check_nh_list). The fix adds nh->lock protection to both walk paths, with fib6_rt_update() using gfp_any() (returning GFP_ATOMIC) under the lock (Github Advisory, Feedly).

Successful exploitation can cause a kernel crash (denial of service) or memory corruption on affected Linux systems. A local user with the ability to trigger concurrent IPv6 route operations and nexthop replace operations can exploit this race condition to read freed kernel memory, potentially leading to information disclosure or kernel instability. The primary impact is availability (kernel panic/crash), with secondary risk of memory corruption that could theoretically be leveraged for privilege escalation, though no such exploitation has been demonstrated (Feedly, Github Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires local access to trigger concurrent IPv6 routing operations, limiting its attack surface. The EPSS score is 0.0, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution has been reported (Feedly, Github Advisory).

Apply the upstream kernel patches that add nh->lock protection to fib6_check_nh_list() and __nexthop_replace_notify(). The fix is available in commits bb2b072c619c1f741a6234257050f72005dc63ef and 072cd1f21819dedd2252e704d255de3b0cfc61a7 in the stable kernel tree. Upgrade to Linux kernel 7.1.8 or later (in the 7.1.x series), or 7.2-rc6 or later; versions prior to 6.16 are not affected. No configuration-based workaround is known; patching is the recommended remediation (Github Advisory, Feedly).