CVE-2026-74581

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6_rule_suppress(), when a route is suppressed and released via ip6_rt_put_flags(), the res->rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6_rule_lookup() returns the stale (freed) rt6_info to its caller. The subsequent dst_release() then operates on freed memory, hitting rcuref_put_slowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges.

Red Hat has rated this vulnerability as Important because an unprivileged local user capable of creating new user and network namespaces can acquire the network administrative privileges necessary to configure custom IPv6 routing rules, allowing them to compromise kernel stability or potentially gain elevated privileges. Although policy routing configuration normally requires elevated permissions, the availability of unprivileged user namespaces on default enterprise configurations permits non-root accounts to fulfill this prerequisite in an isolated namespace. Because successful exploitation corrupts kernel memory within the network routing subsystem, the entire host is exposed to system crashes or arbitrary code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, disable the ipv6 kernel module at boot using the kernel command-line parameter:

grubby --update-kernel=ALL --args="ipv6.disable=1"

A reboot is required for this change to take effect. To verify after reboot:

cat /proc/cmdline | grep -o ipv6.disable=1
sysctl net.ipv6.conf.all.disable_ipv6

Applications or services that rely on the IPv6 protocol cannot use this mitigation and should prioritize applying the fix.