CVE-2026-74288

A flaw was found in the Linux kernel's networking subsystem. During the process of dumping network routing rules (fib_rules_dump()), a race condition could occur where a 'dying' rule (one being deallocated) is incorrectly accessed. This could lead to a reference count error, potentially causing a system crash and resulting in a denial of service (DoS).

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires local system access to trigger routing rule dumps during concurrent rule deletion, limiting the blast radius to a denial of service without compromising confidentiality or data integrity. Standard deployments are not exposed to unauthenticated remote attackers. An authenticated local user could potentially trigger an assertion failure or kernel crash by racing FIB rule removal against rule iteration over netlink.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.