Executive brief
The Linux kernel's IPv4 routing table management contains a use-after-free vulnerability in the fib_leaf_notify() function that can be triggered during network namespace cleanup. Network drivers (mlxsw, rocker, netdevsim) that process routing events can dereference freed memory when holding references to dying routing entries, leading to kernel crashes or potential code execution.
Technical details
The vulnerability is a use-after-free in the IPv4 FIB (Forwarding Information Base) notification path. When fib_leaf_notify() dumps fib_info entries under RCU lock, callers like mlxsw_sp_router_fib4_event(), rocker_router_fib_event(), and nsim_fib4_prepare_event() call fib_info_hold() / refcount_inc() on entries that may be in a dying state. This is unsafe because refcount_inc() is not atomic-safe for zero references; refcount_inc_not_zero() is required but would be too late. The fix ensures fib_info lifetime guarantees within fib_leaf_notify() itself. The attack vector is network-adjacent (local network namespace manipulation during cleanup), and no user interaction or prior authentication is required.
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-08-15: disclosed
- other: CVE-2026-74289 assigned