CVE-2026-74630

A flaw was found in the Linux kernel's IPv6 subsystem. The in6_dev_get() function can incorrectly increment the reference count of an inet6_dev object after it has been freed, leading to a use-after-free vulnerability. A local attacker could exploit this to cause memory corruption, potentially resulting in a denial of service or other undefined behavior.

Red Hat has evaluated this vulnerability as having an Important severity impact because a local, authenticated attacker could exploit a race condition during network interface destruction to trigger a use-after-free condition in kernel space, potentially achieving local privilege escalation or causing a kernel panic. Because IPv6 support is enabled by default across Red Hat Enterprise Linux installations, standard user sessions can invoke the affected network socket paths. Although successful exploitation relies on winning a race condition against interface unregistration, the flaw directly threatens system integrity and availability without requiring elevated privileges.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.