Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74581— net: ipv6: clear suppressed fib6 rule result

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，已修复以下漏洞： 网络子系统（IPv6）：清除被抑制的 fib6 规则结果 函数在调用 丢弃被抑制的路由时，未将 指针置空，导致 仍然指向已释放的 结构。 如果后续没有其他规则提供替代路由， 仍会检测到 非空，并将该过期的 （目的节点）返回给调用者。因此，一个抑制规则可能会将被释放的路由重新泄露回 ，随后的引用计数释放操作（ ）将导致进入 中的慢速路径 ，从而引发潜在的安全问题或系统不稳定。 修复方法：在抑制路由时，将 清零，使得被抑制的查找操作能够正确回退到空目的节点（null dst），

CVSS 9.8 · Critical EPSS 0.40% · P33

Possible ATT&CK Techniques 1 AI

T1203 · Exploitation for Client Execution

Affected Version Matrix 22

VendorProduct Version RangeStatus
Linux Linux 209d35ee34e25f9668c404350a1c86d914c54ffa< 90c57310e266eb94e4a80d6b15a9ca131d2e82cb affected
8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383< 5d29b286c9de0b309e94b9ed083aa1a2f429434f affected
cdef485217d30382f3bf6448c54b4401648fe3f1< 354db6243eca59e9d187ffbf8b7955b044ce84dc affected
cdef485217d30382f3bf6448c54b4401648fe3f1< 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa affected
cdef485217d30382f3bf6448c54b4401648fe3f1< 9bad152c42b37499162367fe47867411e62fffa3 affected
cdef485217d30382f3bf6448c54b4401648fe3f1< dc3ab04220667f254f4348572b2a0b3febff89fb affected
cdef485217d30382f3bf6448c54b4401648fe3f1< a341c091ca0bfae377747b1b59a3bd8ebe18a937 affected
cdef485217d30382f3bf6448c54b4401648fe3f1< 6aea62e433fe1b586202a5fee8b5807ce635e1d7 affected
… +14 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74581

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
net: ipv6: clear suppressed fib6 rule result
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 209d35ee34e25f9668c404350a1c86d914c54ffa ~ 90c57310e266eb94e4a80d6b15a9ca131d2e82cb -
Linux Linux 5.16 -

II. Public POCs for CVE-2026-74581

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74581

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74581 (8)

Same Patch Batch · Linux · 2026-08-21 · 4 CVEs total

CVE-2026-74580 8.8 HIGH vhost: reset the vring metadata cache on vring reconfiguration
CVE-2026-74583 7.8 HIGH net/sched: cls_route: fix fastmap use-after-free on filter
CVE-2026-74582 7.8 HIGH packet: use consistent hard_header_len in non-ring send paths

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74581

No comments yet

Leave a comment