Use-After-Free Vulnerability in Linux Kernel's IPv4 Routing Functionality

CVE-2026-64572

What is CVE-2026-64572?

In the Linux kernel, a vulnerability exists in the IPv4 routing functionality where improper memory handling can lead to a Use-After-Free condition. Specifically, the issue arises during the insertion of a new fib_alias into the routing table. If an error occurs before the completion of the insertion, the newly published alias may be accessed by concurrent lookup processes even after being freed, leading to potential exploitation. This vulnerability requires elevated privileges, such as CAP_NET_ADMIN, to trigger successfully. Proper memory cleanup and management are essential to mitigate risks associated with this flaw.

References