Use-after-free in Linux kernel - CVE-2026-74583

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the route4 fastmap cache in the cls_route classifier when classifying packets concurrently with filter deletion or modification. A local user can trigger concurrent packet classification and filter updates to cause a denial of service.

The issue is caused by a race in which an in-flight reader can republish a stale filter pointer into the fastmap after the entry has been reset and before the deferred free completes.

Affected software

How to mitigate CVE-2026-74583

External References

• https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc
• https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df
• https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f
• https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f
• https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139
• https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1
• https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d
• https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2

Related Security Bulletins

• Use-after-free in Linux kernel sched
• Debian update for linux