CVE-2026-74583: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-74583 is a use-after-free (UAF) vulnerability in the Linux kernel's net/sched subsystem, specifically in the cls_route (route4) traffic classifier's fastmap cache. The flaw arises from a race condition between reader and writer threads operating on the fastmap cache, allowing a stale pointer to freed memory to be cached and subsequently dereferenced. It affects Linux kernel versions from 3.18 up to (but not including) the fixed stable releases. Patched versions include 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, and 7.2. The vulnerability was published on August 21, 2026, and carries an estimated CVSS severity of Medium (Red Hat CVE, GitHub Advisory).

The root cause is classified as CWE-416 (Use After Free) / CWE-825 (Expired Pointer Dereference). The route4 classifier maintains a 16-slot fastmap cache of raw struct route4_filter pointers indexed by (id, iif) tuple. The race condition occurs as follows: a reader thread (route4_classify) walks the RCU-protected bucket chain and finds a filter f; concurrently, a writer thread (route4_delete or route4_change) unlinks f, calls route4_reset_fastmap() to clear the cache, then queues an RCU-deferred kfree(f); the reader then calls route4_set_fastmap() and writes the now-to-be-freed pointer f back into the cache after the writer's reset; after the RCU grace period, kfree(f) executes; the next packet matching the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory. The fix introduces a per-filter boolean dying flag that suppresses stale fastmap republishing by in-flight readers. The vulnerability was reproduced using an mdelay(100) accelerator and a concurrent add/delete stress test, triggering KASAN slab-use-after-free reports (Red Hat CVE, GitHub Advisory).

Successful exploitation of this vulnerability by a local user with network privileges can cause a kernel crash (denial of service) through a use-after-free memory access in the route4 fastmap path. The primary impact is availability — an attacker can crash the kernel by sending crafted traffic classified by the route4 qdisc during concurrent filter add/delete operations. While the immediate impact is denial of service, use-after-free vulnerabilities in kernel memory management can in some cases be leveraged for privilege escalation or information disclosure, though no such exploitation has been demonstrated for this specific flaw (Red Hat CVE).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat CVE). Exploitation requires local access with network privileges and the ability to perform concurrent route4 filter additions and deletions while traffic is being classified, making opportunistic remote exploitation unlikely. The EPSS score is approximately 0.165%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was reported with reproduction assistance from ZDI and researcher Santosh (GitHub Advisory).

Apply the upstream kernel patch that introduces a per-filter dying boolean flag to suppress stale fastmap republishing by in-flight readers. Upgrade to one of the following patched stable kernel versions: 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. As a temporary workaround, avoid concurrent route4 filter additions and deletions while traffic is actively being classified by the route4 qdisc. Red Hat has tracked this issue via Bugzilla (Red Hat Bugzilla, GitHub Advisory).