Executive brief
The Linux kernel's IPv6 networking subsystem has a use-after-free vulnerability in the in6_dev_get() function that manages IPv6 interface objects. An unprivileged local user can exploit this to access freed memory and potentially crash the system or escalate privileges by triggering a race condition during network device teardown.
Technical details
The vulnerability is a use-after-free race condition in the in6_dev_get() function within the IPv6 address configuration code. The function reads a device pointer under RCU protection but then unconditionally increments its refcount without checking if the object has already been freed. Between the read and the increment, device teardown can clear the pointer and drop the final reference, causing the increment to resurrect an already-queued RCU free. The fix replaces the unconditional refcount_inc() with refcount_inc_not_zero(), which safely returns NULL if the refcount has reached zero. The vulnerability is triggered from user-space via the ip6_mc_source() code path and requires only unprivileged local access; KASAN traces show heap corruption and reference underflows.
Affected products
- Linux Linux kernel v7.2-rc3 and earlier; patched in upstream and stable branches
Timeline
- 2026-08-22: disclosed: CVE-2026-74630 published
- 2026-08-04: patched: Upstream fix committed by Jakub Kicinski
- 2026-08-03: other: Patch authored by Kyle Zeng (OpenAI Security Research) and David Lee (Trail of Bits)