Linux Kernel Vulnerability in RDS TCP Component

CVE-2026-74563

What is CVE-2026-74563?

A vulnerability exists in the RDS (Remote Data Services) TCP portion of the Linux kernel, specifically within the handling of scoped IPv6 interfaces. This issue arises when the function rds_tcp_laddr_check() uses dev_get_by_index_rcu() to obtain a network device reference and subsequently drops the RCU (Read-Copy-Update) lock before passing the network device structure to ipv6_chk_addr(). This may lead to a use-after-free condition, as the network device could potentially be freed by another process after the RCU unlock, resulting in dereferencing invalid memory. To resolve this, it is crucial to maintain the RCU lock across the ipv6_chk_addr() call, ensuring the network device remains valid for the duration of its use, thus preventing memory access violations and ensuring system stability.

References