---
id: CVE-2026-74562
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nexthop: take nh->lock for f6i_list walks in replace check and notify

  fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list
  during an RTNL-serialized n…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nexthop: take nh->lock for f6i_list walks in replace check and notify

  fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list
  during an RTNL-serialized n…
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 081efd18326e353c6fbfdeff903a83edde953f72 <
    4b296d176580a85ccbc7135ebdf66c42087b23a2
  - >-
    Linux >= 081efd18326e353c6fbfdeff903a83edde953f72 <
    bb2b072c619c1f741a6234257050f72005dc63ef
  - >-
    Linux >= 081efd18326e353c6fbfdeff903a83edde953f72 <
    072cd1f21819dedd2252e704d255de3b0cfc61a7
  - Linux 6.16
published: '2026-08-15'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:47.710'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74562'
references:
  - url: 'https://git.kernel.org/stable/c/072cd1f21819dedd2252e704d255de3b0cfc61a7'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/4b296d176580a85ccbc7135ebdf66c42087b23a2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bb2b072c619c1f741a6234257050f72005dc63ef'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00165
epssPercentile: 0.05325
ingestedAt: '2026-10-15T11:00:41.673Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nexthop: take nh->lock for f6i_list walks in replace check and notify

fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list
during an RTNL-serialized nexthop replace without holding nh->lock. IPv6
RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under
nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a
concurrent route delete that unlinks and frees a fib6_info:

  BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799)
  Read of size 4 at addr ffff888014607e64 by task exploit/143
   rt6_fill_node.isra.0 (net/ipv6/route.c:5799)
   fib6_rt_update (net/ipv6/route.c:6412)
   __nexthop_replace_notify (net/ipv4/nexthop.c:2542)
   rtm_new_nexthop (net/ipv4/nexthop.c:2554)
   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

  BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605)
  Read of size 8 at addr ffff888014a7d068 by task exploit/142
   fib6_check_nh_list (net/ipv4/nexthop.c:1605)
   rtm_new_nexthop (net/ipv4/nexthop.c:2575)
   rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

Both walks only read the entries and take no tb6_lock, so protect them
with nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC
under the lock.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.