Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-64572— ipv4: fib: free fib_alias with kfree_rcu() on insert error path

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.6版本存在安全漏洞，该漏洞源于插入错误路径中释放后重用，可能导致并发查找读取已释放内存。

AI Predicted 7.8 Difficulty: Hard EPSS 0.20% · P9

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux a6c76c17df021b141b0d306828c9fe4ba2d2717c< 9d0778571def598c31e84a38ae5a7ebc6f65e6d8 affected
a6c76c17df021b141b0d306828c9fe4ba2d2717c< bb03350f974aec352b660d032a1d283eb462165a affected
a6c76c17df021b141b0d306828c9fe4ba2d2717c< 6429c9cfd941e62acd7bb0bc64d631574d4c3b2a affected
a6c76c17df021b141b0d306828c9fe4ba2d2717c< 8150b5365f026e72250cacc527ea00be30f40105 affected
a6c76c17df021b141b0d306828c9fe4ba2d2717c< d007056868723de9c0cc3f5ffaad47a8d468b9a4 affected
a6c76c17df021b141b0d306828c9fe4ba2d2717c< cb8be318b4432abd88d3172ec157330f27a5f7a7 affected
a6c76c17df021b141b0d306828c9fe4ba2d2717c< b8d2ea75c76abcd0d72679c2f488271f573e32fb affected
a6c76c17df021b141b0d306828c9fe4ba2d2717c< f2f152e94a67bc746afaf05a1b2702c195553112 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-64572

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free(). fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free: BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56 Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough. Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一款操作系统内核。 Linux kernel 5.6版本存在安全漏洞，该漏洞源于插入错误路径中释放后重用，可能导致并发查找读取已释放内存。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux a6c76c17df021b141b0d306828c9fe4ba2d2717c ~ 9d0778571def598c31e84a38ae5a7ebc6f65e6d8 -
Linux Linux 5.6 -

II. Public POCs for CVE-2026-64572

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-64572

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-64572 (8)

Same Patch Batch · Linux · 2026-08-05 · 17 CVEs total

CVE-2026-64566 9.8 CRITICAL xfrm: iptfs: propagate SKBFL_SHARED_FRAG in iptfs_skb_add_frags()
CVE-2026-64578 8.2 HIGH ksmbd: validate compound request size before reading StructureSize2
CVE-2026-64567 7.8 HIGH btrfs: reject free space cache with more entries than pages
CVE-2026-64568 7.8 HIGH wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
CVE-2026-64570 7.8 HIGH wifi: mac80211: fix fils_discovery double free on alloc failure
CVE-2026-64574 7.8 HIGH wifi: mac80211: tear down new links on vif update error path
CVE-2026-64575 7.8 HIGH bpf: tcp: fix double sock release on batch realloc
CVE-2026-64580 7.8 HIGH xfrm6: clear dst.dev on error to avoid double netdev_put in xfrm6_fill_dst()
CVE-2026-64581 7.8 HIGH xfrm: fix sk_dst_cache double-free in xfrm_user_policy()
CVE-2026-64582 7.8 HIGH RDMA/rxe: Fix a use-after-free problem in rxe_mmap
CVE-2026-64577 7.5 HIGH gtp: check skb_pull_data() return in gtp1u_send_echo_resp()
CVE-2026-64576 7.1 HIGH nexthop: initialize extack in nh_res_bucket_migrate()
CVE-2026-64569 mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
CVE-2026-64571 wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
CVE-2026-64573 Bluetooth: qca: fix NVM tag length underflow in TLV parser
CVE-2026-64579 xfrm: policy: preallocate inexact bins before xfrm_hash_rebuild reinsert

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-64572

No comments yet

Leave a comment