---
id: CVE-2026-74656
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: fix use-after-free in fib_nhc_update_mtu()

  fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
  RTNL does not serialize this walk with PMTU exc…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: fix use-after-free in fib_nhc_update_mtu()

  fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
  RTNL does not serialize this walk with PMTU exc…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    fd39e711866498ae94fcf9acf6f422a4f045b681
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    e1e602d6b22d5cb1641c4459c487eb18bf569e0a
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    e00f7d2b5f2540a3415a229c982af7a25ff6362e
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    dfe388da13aa784851e5ebbea90afbb099075761
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    5a28a4b22dde92f9d293b94236314b8d6181dc4a
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    63996ffc594d128ccec8fc0983f91effd2d3adc4
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    ed503eaad62f20cdd5122d7c3078a648a99c8f16
  - >-
    Linux >= af7d6cce53694a88d6a1bb60c9a239a6a5144459 <
    bc5bde9ce3cc36502839dfe98e068f7303a50982
  - Linux b427832009b97a3ee412ef643a80b15372a7754d
  - Linux 2b7e4c735933be79882aba2bed9afa789e03c62f
  - Linux 8d59c3a6376bbc6dd3f7303968a719ffba75a4f1
  - Linux 9b4869cf385aa16f89c0f019eed4ec4e36aa441c
  - Linux ff34695ced21e2dfa04d0fa1c5f6c35011fa8117
  - Linux >= 3.16.62 < 3.17
  - Linux >= 4.4.162 < 4.5
  - Linux >= 4.9.134 < 4.10
  - Linux >= 4.14.77 < 4.15
  - Linux >= 4.18.15 < 4.19
  - Linux 4.19
published: '2026-08-22'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T20:17:49.840'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74656'
references:
  - url: 'https://git.kernel.org/stable/c/5a28a4b22dde92f9d293b94236314b8d6181dc4a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/63996ffc594d128ccec8fc0983f91effd2d3adc4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc5bde9ce3cc36502839dfe98e068f7303a50982'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dfe388da13aa784851e5ebbea90afbb099075761'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e00f7d2b5f2540a3415a229c982af7a25ff6362e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e1e602d6b22d5cb1641c4459c487eb18bf569e0a'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ed503eaad62f20cdd5122d7c3078a648a99c8f16'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fd39e711866498ae94fcf9acf6f422a4f045b681'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00126
epssPercentile: 0.02236
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T19:13:56.950831Z'
ingestedAt: '2026-10-14T13:30:58.528Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fix use-after-free in fib_nhc_update_mtu()

fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but
RTNL does not serialize this walk with PMTU exception updates. The walk
uses rcu_dereference_protected() with a constant true condition without
holding fnhe_lock.

The following interleaving can therefore occur:

  CPU 0                              CPU 1
  fib_nhc_update_mtu()               update_or_create_fnhe()
    load fnhe                          spin_lock_bh(&fnhe_lock)
                                       fnhe_remove_oldest()
                                         unlink fnhe
                                         kfree_rcu(fnhe, rcu)
    <quiescent state>
    access fnhe after grace period

KASAN reported:

  BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df/0x410
  Read of size 8 at addr ffff888107d49000 by task poc/90
  Call Trace:
   fib_nhc_update_mtu+0x3df/0x410
   fib_sync_mtu+0x7a/0xd0
   fib_netdev_event+0x229/0x3f0
   netif_set_mtu_ext+0x33a/0x570
   dev_set_mtu+0x88/0x120

The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a
pair and other writers serialize them with fnhe_lock. RCU alone prevents
reclamation, but would still allow concurrent writers to leave a mixed
pair.

Walk the table under RCU and acquire fnhe_lock only while updating each
exception. RCU keeps the current entry alive while the short critical
section serializes its paired PMTU fields. This avoids holding the global
lock while scanning all 2048 buckets for every nexthop.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.