CVE-2026-74496

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the fou create() function. The function publishes struct fou via sk user data before adding the new FOU port to the per-netns list. If the fou add to port list() function fails, the error path frees fou while it remains reachable through sk user data. Consequently, a concurrent receive operation can dereference the freed object within the fou from sock() function. This condition is reachable when local port 0 is requested, as fou cfg cmp() may report -EALREADY once an entry already exists.

Recommendations Update the Linux kernel to a version where the fou create() function is patched to release the tunnel socket before freeing fou and utilizes kfree rcu() for reclamation to protect concurrent RCU readers.