Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-74656— ipv4: fix use-after-free in fib_nhc_update_mtu()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： ipv4：修复 中的释放后使用（use-after-free）漏洞 函数在持有 RTNL 锁的情况下遍历 nexthop 异常表（nexthop exception table），但 RTNL 锁并不能将该遍历操作与 PMTU 异常更新操作进行序列化。该遍历操作使用了带有常量真条件的 函数，却并未持有 锁。 因此，可能发生如下交错执行的情况： KASAN（内核地址sanitize器）报告如下： 该遍历操作还会更新 和 字段。这两个字段构成一对，其他写入方通过 对它们进行

CVSS 7.8 · High EPSS 0.22% · P13

Possible ATT&CK Techniques 1 AI

T1135 · Network Share Discovery

Affected Version Matrix 28

VendorProduct Version RangeStatus
Linux Linux af7d6cce53694a88d6a1bb60c9a239a6a5144459< fd39e711866498ae94fcf9acf6f422a4f045b681 affected
af7d6cce53694a88d6a1bb60c9a239a6a5144459< e1e602d6b22d5cb1641c4459c487eb18bf569e0a affected
af7d6cce53694a88d6a1bb60c9a239a6a5144459< e00f7d2b5f2540a3415a229c982af7a25ff6362e affected
af7d6cce53694a88d6a1bb60c9a239a6a5144459< dfe388da13aa784851e5ebbea90afbb099075761 affected
af7d6cce53694a88d6a1bb60c9a239a6a5144459< 5a28a4b22dde92f9d293b94236314b8d6181dc4a affected
af7d6cce53694a88d6a1bb60c9a239a6a5144459< 63996ffc594d128ccec8fc0983f91effd2d3adc4 affected
af7d6cce53694a88d6a1bb60c9a239a6a5144459< ed503eaad62f20cdd5122d7c3078a648a99c8f16 affected
af7d6cce53694a88d6a1bb60c9a239a6a5144459< bc5bde9ce3cc36502839dfe98e068f7303a50982 affected
… +20 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-74656

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ipv4: fix use-after-free in fib_nhc_update_mtu()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: fix use-after-free in fib_nhc_update_mtu() fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but RTNL does not serialize this walk with PMTU exception updates. The walk uses rcu_dereference_protected() with a constant true condition without holding fnhe_lock. The following interleaving can therefore occur: CPU 0 CPU 1 fib_nhc_update_mtu() update_or_create_fnhe() load fnhe spin_lock_bh(&fnhe_lock) fnhe_remove_oldest() unlink fnhe kfree_rcu(fnhe, rcu) <quiescent state> access fnhe after grace period KASAN reported: BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410 Read of size 8 at addr ffff888107d49000 by task poc/90 Call Trace: fib_nhc_update_mtu+0x3df/0x410 fib_sync_mtu+0x7a/0xd0 fib_netdev_event+0x229/0x3f0 netif_set_mtu_ext+0x33a/0x570 dev_set_mtu+0x88/0x120 The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a pair and other writers serialize them with fnhe_lock. RCU alone prevents reclamation, but would still allow concurrent writers to leave a mixed pair. Walk the table under RCU and acquire fnhe_lock only while updating each exception. RCU keeps the current entry alive while the short critical section serializes its paired PMTU fields. This avoids holding the global lock while scanning all 2048 buckets for every nexthop.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux af7d6cce53694a88d6a1bb60c9a239a6a5144459 ~ fd39e711866498ae94fcf9acf6f422a4f045b681 -
Linux Linux 4.19 -

II. Public POCs for CVE-2026-74656

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-74656

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-74656 (8)

Same Patch Batch · Linux · 2026-08-22 · 150 CVEs total

CVE-2026-74612 10.0 CRITICAL veth: fix skb length accounting after XDP frag adjustment
CVE-2026-74705 10.0 CRITICAL udp: fix potential use-after-free in tunnel segmentation
CVE-2026-74730 9.8 CRITICAL NFS: Pin the 'struct nfs_server' during a FREE_STATEID call
CVE-2026-74591 9.8 CRITICAL mm/filemap: __filemap_add_folio() restore index before retrying
CVE-2026-74662 9.8 CRITICAL inet: frags: publish queues before arming timer
CVE-2026-74669 9.8 CRITICAL ipvs: clear IPv4 options after rebasing tunnel ICMP errors
CVE-2026-74608 9.8 CRITICAL smb: client: Fix use-after-free in cifs_try_adding_channels()
CVE-2026-74628 9.8 CRITICAL net/x25: fix use-after-free of the socket by its timers
CVE-2026-74688 9.8 CRITICAL sctp: clear control chunk transport if it is being removed
CVE-2026-74587 9.8 CRITICAL sctp: fix use-after-free of cached ASCONF chunk
CVE-2026-74588 9.8 CRITICAL sctp: keep chunk->transport in step with the list it is queued on
CVE-2026-74616 9.8 CRITICAL xdp: reject clones that overrun skb_shared_info tailroom
CVE-2026-74727 9.8 CRITICAL ovpn: skip rehash for peers already removed from by_id
CVE-2026-74586 9.8 CRITICAL sctp: clear new_transport when removing a peer
CVE-2026-74723 9.8 CRITICAL btrfs: lzo: reject inline extents without valid headers
CVE-2026-74617 9.8 CRITICAL dibs: initialise dibs->lock in dibs_dev_alloc()
CVE-2026-74611 9.8 CRITICAL tls: rx: restore msg_iter before TLS 1.3 optimistic retry
CVE-2026-74597 9.8 CRITICAL ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
CVE-2026-74712 9.3 CRITICAL vdpa/mlx5: Fix buffer length in create_direct_keys()
CVE-2026-74665 9.1 CRITICAL net: fix skb length accounting after generic XDP frag adjustment

Showing top 20 of 150 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-74656

No comments yet

Leave a comment