Executive brief
The Linux kernel's networking stack manages routes and nexthops (network hop configurations). A race condition in the nexthop module can cause the kernel to access memory that has already been freed when replacing a nexthop while IPv6 routes are being added or deleted simultaneously. This can lead to kernel crashes, denial of service, or potential privilege escalation on affected systems.
Technical details
A use-after-free vulnerability exists in the nh_rt_cache_flush() function in net/ipv4/nexthop.c. The function walks the nh->f6i_list without holding the nh->lock spinlock, creating a race condition with concurrent IPv6 route add/delete operations that mutate the list under nh->lock and free fib6_info entries. The KASAN report confirms a slab-use-after-free read during nexthop replacement (rtm_new_nexthop). The vulnerable code attempted to update serialization numbers via fib6_update_sernum_upto_root() for each route, but this creates lock-order inversion risks. The fix replaces the unsafe per-route iteration with a single rt_genid_bump_ipv6() call to invalidate the entire IPv6 cache atomically. The vulnerability is triggered during RTNL-serialized nexthop replace operations and requires network namespace access (typically root/CAP_NET_ADMIN).
Affected products
- Linux Linux Kernel Affected versions not explicitly specified in advisory; fix included in stable series from 2026-08-09 onward
Timeline
- 2026-08-15: disclosed: Published on NVD
- 2026-07-24: patched: Upstream fix merged by Jakub Kicinski
- 2026-08-09: patched: Included in stable releases by Greg Kroah-Hartman