{"id":"CVE-2026-74581","revision":"c75e5cfa36ce4fbbb015e22b72131389","records":[{"revision":"c75e5cfa36ce4fbbb015e22b72131389","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-74581","aliases":[],"title":"net: ipv6: clear suppressed fib6 rule result","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res->rt6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res->rt6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one.","state":0,"publishedAt":"2026-08-21T16:31:54.683+00:00","modifiedAt":"2026-10-16T19:05:58.061+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/fib6_rules.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"209d35ee34e25f9668c404350a1c86d914c54ffa\",\n                            \"lessThan\": \"90c57310e266eb94e4a80d6b15a9ca131d2e82cb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383\",\n                            \"lessThan\": \"5d29b286c9de0b309e94b9ed083aa1a2f429434f\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdef485217d30382f3bf6448c54b4401648fe3f1\",\n                            \"lessThan\": \"354db6243eca59e9d187ffbf8b7955b044ce84dc\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdef485217d30382f3bf6448c54b4401648fe3f1\",\n                            \"lessThan\": \"6d98c70fe0ba8c7708bfd5b2a5174d2086775daa\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdef485217d30382f3bf6448c54b4401648fe3f1\",\n                            \"lessThan\": \"9bad152c42b37499162367fe47867411e62fffa3\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdef485217d30382f3bf6448c54b4401648fe3f1\",\n                            \"lessThan\": \"dc3ab04220667f254f4348572b2a0b3febff89fb\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdef485217d30382f3bf6448c54b4401648fe3f1\",\n                            \"lessThan\": \"a341c091ca0bfae377747b1b59a3bd8ebe18a937\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cdef485217d30382f3bf6448c54b4401648fe3f1\",\n                            \"lessThan\": \"6aea62e433fe1b586202a5fee8b5807ce635e1d7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5.10.84\",\n                            \"lessThan\": \"5.10.265\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.7\",\n                            \"lessThan\": \"5.15.216\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.4.164\",\n                            \"lessThan\": \"5.5\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"net/ipv6/fib6_rules.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.265\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.216\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.183\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.151\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.103\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.44\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.1.8\",\n                            \"lessThanOrEqual\": \"7.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb","https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f","https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc","https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa","https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3","https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb","https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937","https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-74581","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-74581","identifiers":["CVE-2026-74581"]},"retained":false,"historicalAffected":[]}],"coverage":[]}