CVE-2026-74561

A flaw was found in the Linux kernel, specifically within its nexthop component responsible for network routing. A timing issue, known as a race condition, allows the system to access memory after it has been freed. This occurs when the kernel attempts to flush its routing cache while other operations are simultaneously modifying IPv6 routes. An attacker could potentially exploit this vulnerability to cause a system crash, leading to a denial of service, or in some cases, execute unauthorized code.

An unlocked walk of the nexthop IPv6 f6i_list in nh_rt_cache_flush can race with IPv6 route add or delete operations that mutate the same list and free fib6_info entries. This creates a slab use-after-free during nexthop replace through rtnetlink, with KASAN showing a stale fib6_info read in nh_rt_cache_flush. For the CVSS the PR:L is used because reliable triggering requires a local process with route administration capability such as CAP_NET_ADMIN, which can be delegated to containers or service accounts and should not be treated as full host root in practical risk terms. The issue is not directly network reachable because the trigger is a local netlink control plane operation, not packet processing. Impact is at least local denial of service via kernel crash and in the paranoid score may allow confidentiality or integrity impact because the primitive is a kernel UAF race rather than a pure NULL dereference.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.