CVE-2026-74656

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv4: fix use-after-free in fib_nhc_update_mtu()<br /> <br /> fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but<br /> RTNL does not serialize this walk with PMTU exception updates. The walk<br /> uses rcu_dereference_protected() with a constant true condition without<br /> holding fnhe_lock.<br /> <br /> The following interleaving can therefore occur:<br /> <br /> CPU 0 CPU 1<br /> fib_nhc_update_mtu() update_or_create_fnhe()<br /> load fnhe spin_lock_bh(&amp;fnhe_lock)<br /> fnhe_remove_oldest()<br /> unlink fnhe<br /> kfree_rcu(fnhe, rcu)<br /> <br /> access fnhe after grace period<br /> <br /> KASAN reported:<br /> <br /> BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410<br /> Read of size 8 at addr ffff888107d49000 by task poc/90<br /> Call Trace:<br /> fib_nhc_update_mtu+0x3df/0x410<br /> fib_sync_mtu+0x7a/0xd0<br /> fib_netdev_event+0x229/0x3f0<br /> netif_set_mtu_ext+0x33a/0x570<br /> dev_set_mtu+0x88/0x120<br /> <br /> The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a<br /> pair and other writers serialize them with fnhe_lock. RCU alone prevents<br /> reclamation, but would still allow concurrent writers to leave a mixed<br /> pair.<br /> <br /> Walk the table under RCU and acquire fnhe_lock only while updating each<br /> exception. RCU keeps the current entry alive while the short critical<br /> section serializes its paired PMTU fields. This avoids holding the global<br /> lock while scanning all 2048 buckets for every nexthop.