CVE-2026-74581: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74581 is a use-after-free vulnerability in the Linux kernel's IPv6 routing subsystem, specifically in the fib6_rule_suppress() function. When a route is suppressed, the function releases the route via ip6_rt_put_flags() but fails to clear res->rt6, leaving a stale pointer to the freed rt6_info structure. Affected kernel versions include 5.4.164–5.5, 5.10.84–5.10.265, 5.15.7–5.15.216, and kernel 5.16 and later branches up to their respective fix commits. It was published on August 21, 2026, and carries a CVSS v3.1 base score of 7.8 (High) (Red Hat CVE, GitHub Advisory).

The root cause is a use-after-free condition (CWE-416) in net/ipv6/fib6_rules.c. When fib6_rule_suppress() drops a suppressed route using ip6_rt_put_flags(), it does not set res->rt6 to NULL. If no subsequent routing rule provides a replacement, fib6_rule_lookup() returns the now-freed rt6_info pointer to its caller (rt6_lookup()). A subsequent dst_release() call on this stale pointer triggers rcuref_put_slowpath(), resulting in a use-after-free. The fix clears res->rt6 upon route suppression so that lookups fall through to the null destination instead of reusing the released object (Red Hat CVE, GitHub Advisory).

A local user with low privileges can trigger this vulnerability through IPv6 routing operations, causing a use-after-free in kernel memory. Successful exploitation can result in arbitrary code execution with kernel privileges, enabling full system compromise, or alternatively crash the system (denial of service). All three security dimensions — confidentiality, integrity, and availability — are rated High, reflecting the potential for complete kernel-level control (Red Hat CVE).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation as of the disclosure date (Red Hat CVE). The vulnerability requires local access with low privileges (e.g., a standard user account), limiting the remote attack surface. The EPSS score is approximately 0.165%, indicating a low near-term probability of exploitation. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection coverage exists via Tenable Nessus plugin 338784 (Tenable).

Patches are available across multiple stable kernel branches. Users should upgrade to the following fixed versions or later: 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, 7.1.8, or 7.2+. The fix is also tracked via Red Hat Bugzilla ID 2520980. As a temporary workaround where patching is not immediately feasible, administrators should restrict unprivileged user access to IPv6 routing configuration and monitor for unexpected kernel crashes or privilege escalation activity related to IPv6 route processing (Red Hat CVE, GitHub Advisory).