CVE-2026-74398

A flaw was found in the Linux kernel's IPv6 address configuration (addrconf) component. A race condition can occur during the Duplicate Address Detection (DAD) failure handling. When addrconf_dad_failure() temporarily releases a lock, a concurrent ipv6_del_addr() operation can modify the network interface state. This can lead to a double-free or use-after-free condition, resulting in a general protection fault and a system crash, effectively causing a Denial of Service (DoS).

IPv6 addrconf DAD failure handling can race with concurrent IPv6 address deletion. addrconf_dad_failure can move an address to POSTDAD and then temporarily release ifp lock, while another path can run ipv6_del_addr, mark the address DEAD, and remove the ifp list entry. The DAD failure path can then overwrite DEAD with ERRDAD and schedule dad_work, causing ipv6_del_addr to run again on an already poisoned list entry and crash the kernel. For the CVSS the PR:N is used for the paranoid score because a network adjacent attacker may trigger DAD failure with ICMPv6 Neighbor Discovery traffic without credentials if the target interface is reachable on the same L2 segment. The issue is not Internet routable in the normal case and exploitation usually requires access to the same local link plus a timing race with address removal. Impact is at least denial of service via kernel crash. In the worst defensible case it may have limited confidentiality or integrity impact because the bug involves a race and stale list state in kernel memory, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.