CVE-2026-74630

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv6: prevent in6_dev_get() from resurrecting inet6_dev<br /> <br /> in6_dev_get() reads dev-&gt;ip6_ptr under RCU and then unconditionally<br /> increments its refcount. Device teardown can clear the pointer and drop<br /> the last reference between these operations. The increment then<br /> resurrects an object whose RCU free has already been queued, so callers<br /> can use it after it is freed.<br /> <br /> Use refcount_inc_not_zero() and return NULL when the object has already<br /> reached zero. RCU keeps the memory accessible through the attempted<br /> reference acquisition, and a successful increment pins the object for<br /> the caller.<br /> <br /> An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3)<br /> kernel reproduced the invalid reference acquisition as UID 1000:<br /> <br /> refcount_t: addition on 0; use-after-free.<br /> ip6_mc_source+0xef4/0x17e0<br /> <br /> It was followed by the corresponding reference underflow in<br /> ip6_mc_source(). The supplied trace from the same unpatched revision<br /> additionally shows the access after the RCU read-side section ends:<br /> <br /> BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0<br /> Write of size 8 at addr ffff888015b50240 by task poc/1219<br /> <br /> Bug found and triaged by OpenAI Security Research and<br /> validated by Trail of Bits.