CVE-2026-74562 Linux CVE debrief

Who should care

Linux kernel developers and maintainers, network administrators responsible for Linux-based systems, security teams monitoring Linux deployments, and operators managing Linux-based infrastructure. They should assess exposure and apply patches or mitigations as necessary.

Why it matters

This vulnerability in the Linux kernel's nexthop implementation can lead to use-after-free reads, potentially causing denial of service or privilege escalation. Linux kernel developers, network administrators, and security teams should assess exposure and apply patches or mitigations as necessary.

• Potential for denial of service (DoS) due to use-after-free reads
• Possible elevation of privileges through exploitation of the vulnerability
• Need for verification of Linux kernel versions and application of patches
• Potential impact on network stability and security

Technical summary

The Linux kernel's nexthop implementation is vulnerable to a use-after-free issue. Specifically, fib6_check_nh_list() and __nexthop_replace_notify() do not hold nh->lock during f6i_list walks, allowing for concurrent modifications to the list. This can result in use-after-free reads when a route deletion occurs simultaneously. The vulnerability is caused by the lack of proper locking during f6i_list walks in fib6_check_nh_list() and __nexthop_replace_notify(). This can lead to use-after-free reads when a concurrent route deletion occurs. The issue is resolved by taking nh->lock for these walks.

Defensive priority

High

Recommended defensive actions

• Review and apply the provided patches to ensure proper locking during f6i_list walks
• Implement additional monitoring to detect potential exploitation attempts
• Verify Linux kernel versions and apply updates as necessary
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is caused by the lack of proper locking during f6i_list walks in fib6_check_nh_list() and __nexthop_replace_notify(). This can lead to use-after-free reads when a concurrent route deletion occurs. The issue is resolved by taking nh->lock for these walks.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.