CVE-2026-74656

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the fib nhc update mtu() function. The function iterates through the nexthop exception table under RTNL, but RTNL does not serialize this process with PMTU exception updates. The process uses rcu dereference protected() with a constant true condition without holding the fnhe lock. This can lead to a race condition where one CPU loads a nexthop exception entry (fnhe) while another CPU removes and frees it via fnhe remove oldest() in the update or create fnhe() function, resulting in a slab-use-after-free when the first CPU attempts to access the entry after the grace period. Additionally, concurrent updates to the fnhe pmtu and fnhe mtu locked variables can result in inconsistent data pairs if not properly serialized with fnhe lock.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.