CVE-2026-74630
Description
A flaw was found in the Linux kernel's IPv6 subsystem. The in6_dev_get() function can incorrectly increment the reference count of an inet6_dev object after it has been freed, leading to a use-after-free vulnerability. A local attacker could exploit this to cause memory corruption, potentially resulting in a denial of service or other undefined behavior.
Statement
Red Hat has evaluated this vulnerability as having an Important severity impact because a local, authenticated attacker could exploit a race condition during network interface destruction to trigger a use-after-free condition in kernel space, potentially achieving local privilege escalation or causing a kernel panic. Because IPv6 support is enabled by default across Red Hat Enterprise Linux installations, standard user sessions can invoke the affected network socket paths. Although successful exploitation relies on winning a race condition against interface unregistration, the flaw directly threatens system integrity and availability without requiring elevated privileges.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | High | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
