Linux Kernel Vulnerability in Nexthop Management by Vendor Linux Foundation

CVE-2026-74561

What is CVE-2026-74561?

A vulnerability in the Linux kernel allows racing conditions during nexthop replacements, leading to potential exploits in the IPv6 routing process. Specifically, the nh_rt_cache_flush() function incorrectly accesses the nh->f6i_list without appropriate locking mechanisms, which may lead to use-after-free errors in the system. This issue arises as the function attempts to manage route state without holding necessary locks, allowing mutated list elements that could lead to data corruption or operational instability. A proper fix involves adjusting the route scheduling to prevent these race conditions and ensuring that route management does not compromise the stability of networking components.

References