CVE-2026-74583

A flaw was found in the Linux kernel's net/sched: cls_route component. A race condition exists in the route4 classifier's fastmap cache, where a reader can re-cache a pointer to a filter that has already been freed by a writer. This can lead to a use-after-free condition, allowing subsequent packet classifications to read from freed memory. The most important consequence is memory corruption, which can result in system instability or a denial of service.

This vulnerability is rated as Important severity because a local user with network administration capabilities—such as within an unprivileged user namespace—can trigger a use-after-free condition to corrupt kernel memory, potentially leading to privilege escalation or a system crash. Exploitation requires manipulating traffic control filters, an administrative capability that is not exposed to standard unprivileged user accounts on default enterprise deployments. Newer releases such as Red Hat Enterprise Linux 9 and 10 are not affected because the vulnerable routing classifier code is not present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this vulnerability, prevent the cls_route kernel module from loading. This can be achieved by creating a modprobe configuration file.

1. Create or edit /etc/modprobe.d/disable-cls_route.conf and add the following line: install cls_route /bin/true
2. Regenerate the initramfs to ensure the change takes effect on boot: dracut -f -v
3. Reboot the system for the changes to be applied. Note that disabling this module may impact network traffic classification functionality if it is actively used.