CVE-2026-74496

A flaw was found in the Linux kernel's Foo Over UDP (FOU) tunnel driver. An ordering issue in the fou_create() function can lead to a use-after-free vulnerability. This occurs when a struct fou object is published before being fully added to the system's list. If the addition fails, the object can be freed while still accessible, allowing a concurrent operation to access the freed memory. This could result in memory corruption and potentially lead to system instability or a denial of service.

fou_create() publishes a struct fou through sk_user_data before the object is safely linked into the per netns FOU port list. If fou_add_to_port_list() fails, the old error path freed the object while it could still be reached from the UDP tunnel socket, and a concurrent receive path could dereference the freed object in fou_from_sock(). For the CVSS the PR:L is used because reliable triggering needs local control of FOU configuration, but this may be available to an unprivileged local user through user namespace or delegated CAP_NET_ADMIN environments. The receive side can be driven by UDP traffic to the affected socket, but the vulnerability is not treated as a pure remote network issue because the dangerous error path is created through local control plane operations. Impact is at least local denial of service via kernel crash and in the paranoid case may include confidentiality and integrity impact because this is an RCU protected use after free pattern with a stale sk_user_data pointer.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.