CVE-2026-74562

A flaw was found in the Linux kernel's nexthop component. A race condition exists where internal lists are walked without proper locking during nexthop replacement and route deletion. A local attacker could exploit this by concurrently manipulating IPv6 routes, leading to a use-after-free vulnerability. This could result in a system crash, causing a denial of service.

A race in nexthop replace handling can let fib6_check_nh_list or __nexthop_replace_notify walk nh f6i_list while a concurrent IPv6 route delete unlinks and frees a fib6_info object. This creates a use after free read in the kernel networking path and can crash the system during rtnetlink route or nexthop operations. For the CVSS the PR:L is selected for the paranoid score because a local process with delegated CAP_NET_ADMIN or container root in a network namespace may be enough in practical deployments. The issue is not directly network reachable and is triggered through local control plane operations rather than packet traffic. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to reuse of freed kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.