CVE-2026-74563

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) TCP module. The rds_tcp_laddr_check() function fails to hold the Read-Copy-Update (RCU) lock across an IPv6 address check. This allows a race condition where a network device can be freed while still being referenced, leading to a use-after-free vulnerability. A local attacker could exploit this to cause a denial of service or potentially gain unauthorized access to sensitive information.

rds_tcp_laddr_check obtains a scoped IPv6 net_device pointer with dev_get_by_index_rcu but previously dropped the RCU read lock before calling ipv6_chk_addr. A concurrent RTM_DELLINK can free the device before ipv6_chk_addr and __ipv6_chk_addr_and_flags dereference it, resulting in a slab use after free on a stale net_device pointer. For the CVSS the PR:L is used because reliable triggering requires a local process able to call bind on an RDS socket and to arrange or race interface removal in the relevant network namespace. AC:H is used because the issue depends on a timing window between RDS bind processing and netdevice unregister. The issue is not directly network reachable. Impact is at least a local denial of service via kernel crash and in worst case may allow confidentiality or integrity impact due to use after free memory corruption and should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.