Critical 9.8Published Aug 21, 2026

CVE-2026-74581net: ipv6: clear suppressed fib6 rule result

Updated under an hour ago (Oct 28, 2026, 6:40 AM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

CVSS: 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Received
Record last updated: Oct 16, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	209d35ee34e25f9668c404350a1c86d914c54ffa builds before 90c57310e266eb94e4a80d6b15a9ca131d2e82cb; 8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383 builds before 5d29b286c9de0b309e94b9ed083aa1a2f429434f; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 354db6243eca59e9d187ffbf8b7955b044ce84dc; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 9bad152c42b37499162367fe47867411e62fffa3; from cdef485217d30382f3bf6448c54b4401648fe3f1 before dc3ab04220667f254f4348572b2a0b3febff89fb; from cdef485217d30382f3bf6448c54b4401648fe3f1 before a341c091ca0bfae377747b1b59a3bd8ebe18a937; from cdef485217d30382f3bf6448c54b4401648fe3f1 before 6aea62e433fe1b586202a5fee8b5807ce635e1d7; and 4 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb
https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f
https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc
https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3
https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb
https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937
https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.