CVE-2026-74581 Linux CVE debrief

Who should care

Linux kernel users and administrators, particularly those responsible for vulnerability management, security teams, and operators who need to ensure their systems are updated with the latest stable kernel version to prevent potential leaks of released routes back to rt6_lookup(). This requires reviewing Linux kernel configurations and ensuring fib6 rule configurations are properly set. Additionally, defenders should verify their systems' configurations and update them as necessary to mitigate this vulnerability. Affected platforms include Linux kernel deployments in managed environments. The vulnerability's impact on operational security can be significant if not properly addressed, as it allows for potential information disclosure and exploitation by attackers. Therefore, it is crucial for affected parties to prioritize verification and remediation efforts based on their specific exposure and risk profile. This may involve coordinating with vendors for patches, reviewing compensating controls, and enhancing monitoring and detection capabilities for exposed assets. The issue's severity underscores the importance of proactive vulnerability management and timely application of security updates to maintain the integrity and security of affected systems. Linux kernel users should also consider implementing additional security measures, such as asset inventory management and source tracking, to further mitigate potential risks associated with this vulnerability. By taking these steps, defenders can reduce the likelihood of exploitation and minimize potential impacts on their operations. Effective communication and collaboration among stakeholders, including operators, security teams, and vendors, are essential for successful remediation and minimizing potential disruptions. Overall, a comprehensive and coordinated approach is necessary to address this vulnerability and ensure the security and integrity of affected Linux kernel deployments. Linux kernel users and administrators must prioritize verification and remediation efforts based on their specific exposure and risk profile to prevent potential exploitation of this vulnerability. This requires a thorough review,

Technical summary

The Linux kernel has a vulnerability in the net: ipv6: clear suppressed fib6 rule result. fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

Defensive priority

Linux kernel users should verify their systems are updated with the latest stable kernel version to ensure they are not vulnerable to this issue.

Recommended defensive actions

• Verify system is updated with the latest stable kernel version
• Review Linux kernel configurations and ensure fib6 rule configurations are properly set
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

The CVE record indicates a vulnerability in the Linux kernel related to net: ipv6: clear suppressed fib6 rule result. fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.