Use-After-Free Vulnerability in Linux Kernel's Route4 Classifier

CVE-2026-74583

What is CVE-2026-74583?

A use-after-free vulnerability exists within the Linux Kernel's Route4 Classifier due to a race condition between reader and writer operations. The route4 classifier maintains a fastmap cache, which can become stale if a filter is deleted while a reader is in the process of classifying packets. This inconsistency allows a malicious actor to exploit freed memory areas, potentially leading to unauthorized access or system instability. The issue is mitigated by introducing a 'dying' flag for filters, preventing outdated fastmap entries from being republished during concurrent operations.

References