CVE-2026-74562

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> nexthop: take nh-&gt;lock for f6i_list walks in replace check and notify<br /> <br /> fib6_check_nh_list() and __nexthop_replace_notify() walk nh-&gt;f6i_list<br /> during an RTNL-serialized nexthop replace without holding nh-&gt;lock. IPv6<br /> RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under<br /> nh-&gt;lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a<br /> concurrent route delete that unlinks and frees a fib6_info:<br /> <br /> BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799)<br /> Read of size 4 at addr ffff888014607e64 by task exploit/143<br /> rt6_fill_node.isra.0 (net/ipv6/route.c:5799)<br /> fib6_rt_update (net/ipv6/route.c:6412)<br /> __nexthop_replace_notify (net/ipv4/nexthop.c:2542)<br /> rtm_new_nexthop (net/ipv4/nexthop.c:2554)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)<br /> <br /> BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605)<br /> Read of size 8 at addr ffff888014a7d068 by task exploit/142<br /> fib6_check_nh_list (net/ipv4/nexthop.c:1605)<br /> rtm_new_nexthop (net/ipv4/nexthop.c:2575)<br /> rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)<br /> <br /> Both walks only read the entries and take no tb6_lock, so protect them<br /> with nh-&gt;lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC<br /> under the lock.