CVE-2026-74561

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the Linux kernel within the nh rt cache flush() function, which is inlined into rtm new nexthop(). The problem occurs when nh rt cache flush() traverses the nh->f6i list during an RTNL-serialized nexthop replace operation without holding the nh->lock. This creates a race condition with unlocked IPv6 route additions or deletions that modify the list under nh->lock and free fib6 info entries. To avoid a deadlock that would occur if nh->lock were taken while needing tb6 lock via the fib6 update sernum upto root() function, the system should instead use rt genid bump ipv6() to bump the IPv6 sernum for the entire network namespace to invalidate cached destinations.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.