CVE-2026-74581
Description
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6_rule_suppress(), when a route is suppressed and released via ip6_rt_put_flags(), the res->rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6_rule_lookup() returns the stale (freed) rt6_info to its caller. The subsequent dst_release() then operates on freed memory, hitting rcuref_put_slowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges.
Statement
Red Hat has rated this vulnerability as Important because an unprivileged local user capable of creating new user and network namespaces can acquire the network administrative privileges necessary to configure custom IPv6 routing rules, allowing them to compromise kernel stability or potentially gain elevated privileges. Although policy routing configuration normally requires elevated permissions, the availability of unprivileged user namespaces on default enterprise configurations permits non-root accounts to fulfill this prerequisite in an isolated namespace. Because successful exploitation corrupts kernel memory within the network routing subsystem, the entire host is exposed to system crashes or arbitrary code execution.
Mitigation
To mitigate this issue, disable the `ipv6` kernel module at boot using the kernel command-line parameter:
grubby --update-kernel=ALL --args="ipv6.disable=1"
A reboot is required for this change to take effect. To verify after reboot:
cat /proc/cmdline | grep -o ipv6.disable=1
sysctl net.ipv6.conf.all.disable_ipv6
Applications or services that rely on the IPv6 protocol cannot use this mitigation and should prioritize applying the fix.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 9.8 |
| Attack Vector | Local | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
