CVE-2026-74630

Name of the Vulnerable Software and Affected Versions Linux kernel version 7.2-rc3

Description A use-after-free issue exists in the IPv6 implementation where the in6 dev get() function reads dev->ip6 ptr under RCU (Read-Copy-Update) and unconditionally increments its reference count. During device teardown, the pointer can be cleared and the last reference dropped between these two operations. This allows the increment to resurrect an object that has already been queued for RCU freeing, leading to a situation where callers use the object after it has been freed. This was observed in the ip6 mc source() function, resulting in a reference underflow and a slab-use-after-free during a mutex lock() operation.

Recommendations Update Linux kernel version 7.2-rc3 to a version where the in6 dev get() function is updated to use refcount inc not zero() and return NULL if the object has already reached zero.