CVE-2026-74288 (GCVE-0-2026-74288)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:57 – Updated: 2026-08-17 05:45
VLAI
Title
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
Summary
In the Linux kernel, the following vulnerability has been resolved: net: fib_rules: Don't dump dying fib_rule in fib_rules_dump(). rocker_router_fib_event() calls fib_rule_get() during RCU dump. If the fib_rule is dying, refcount_inc() will complain about it. Let's call refcount_inc_not_zero() in fib_rules_dump().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < 0f929b59f4cd0e05bb1ecefe12b77e85911d4be2 (git)
Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < 4b7ae30c81c2ee10a644749a3704a5c797ccc308 (git)
Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < 2dfdc210d240bd48bb2ea746430b02b5571b6db9 (git)
Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < a7ef30753353ba6a95d693b1863a0214222a199a (git)
Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < 1fbc6c6efe78f4454a51afa0587efb6826f60f00 (git)
Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < bb4a5b3c91af3c8d705bb2e9f6f8069a70db26fc (git)
Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < 3af0bc1bd9039e2e50abf3e2d7fee411f38bce4e (git)
Affected: 5d7bfd141924a5ece21eb612ad3c56612f041c1e , < 2821e85c058f81c9948a2fb1a634f7b47457d51c (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.12
Unaffected: 0 , < 4.12 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/fib_rules.h",
            "net/core/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "0f929b59f4cd0e05bb1ecefe12b77e85911d4be2",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            },
            {
              "lessThan": "4b7ae30c81c2ee10a644749a3704a5c797ccc308",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            },
            {
              "lessThan": "2dfdc210d240bd48bb2ea746430b02b5571b6db9",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            },
            {
              "lessThan": "a7ef30753353ba6a95d693b1863a0214222a199a",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            },
            {
              "lessThan": "1fbc6c6efe78f4454a51afa0587efb6826f60f00",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            },
            {
              "lessThan": "bb4a5b3c91af3c8d705bb2e9f6f8069a70db26fc",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            },
            {
              "lessThan": "3af0bc1bd9039e2e50abf3e2d7fee411f38bce4e",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            },
            {
              "lessThan": "2821e85c058f81c9948a2fb1a634f7b47457d51c",
              "status": "affected",
              "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/fib_rules.h",
            "net/core/fib_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fib_rules: Don\u0027t dump dying fib_rule in fib_rules_dump().\n\nrocker_router_fib_event() calls fib_rule_get() during RCU dump.\n\nIf the fib_rule is dying, refcount_inc() will complain about it.\n\nLet\u0027s call refcount_inc_not_zero() in fib_rules_dump()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bug is reached only through local kernel networking control paths: fib_rules_dump() runs during register_fib_notifier() and races with RTM_DELRULE netlink handling in fib_delrule(), not via remotely received packets or a network-facing protocol handler.\nAC:L - Exploitation is a race where the attacker concurrently deletes FIB rules (repeated RTM_DELRULE or netns teardown) while fib_rules_dump() replays RULE_ADD events; the attacker controls both sides and can retry, as demonstrated by syzbot during netdevsim reload/cleanup_net.\nPR:L - Triggering concurrent FIB rule deletion requires CAP_NET_ADMIN on the target network namespace, which unprivileged users can obtain inside user/network namespaces (e.g., unshare -Urn), while driver registration commonly occurs in the same namespace during netdevsim/devlink setup.\nUI:N - No end-user or administrator UI action is required beyond programmatic netlink/devlink operations that an attacker can script; exploitation does not depend on a victim opening files, clicking links, or mounting filesystems.\nS:U - Impact is a kernel heap use-after-free in fib_rule handling leading to memory corruption within the host kernel; it does not inherently cross a VM/hypervisor or IOMMU security boundary without separate exploitation of unrelated boundaries.\nC:H - A dying fib_rule can be passed to FIB notifiers after its refcount hits zero; handlers such as rocker_router_fib_event() call fib_rule_get() and later dereference rule fields in workqueues, enabling reads of freed slab memory and potential kernel pointer disclosure.\nI:H - The UAF hands attackers control over the lifetime and contents of freed fib_rule objects; with heap grooming this class of corruption is reasonably leveraged into arbitrary kernel writes or control-flow hijack, not merely a benign warning.\nA:H - refcount_inc() on a zero refcount emits use-after-free warnings and concurrent dereference of freed fib_rule structures during dump/replay can cause kernel oops/panics, especially under automated stress seen in syzbot reproductions."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:45:27.821Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/0f929b59f4cd0e05bb1ecefe12b77e85911d4be2"
        },
        {
          "url": "https://git.kernel.org/stable/c/4b7ae30c81c2ee10a644749a3704a5c797ccc308"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dfdc210d240bd48bb2ea746430b02b5571b6db9"
        },
        {
          "url": "https://git.kernel.org/stable/c/a7ef30753353ba6a95d693b1863a0214222a199a"
        },
        {
          "url": "https://git.kernel.org/stable/c/1fbc6c6efe78f4454a51afa0587efb6826f60f00"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb4a5b3c91af3c8d705bb2e9f6f8069a70db26fc"
        },
        {
          "url": "https://git.kernel.org/stable/c/3af0bc1bd9039e2e50abf3e2d7fee411f38bce4e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2821e85c058f81c9948a2fb1a634f7b47457d51c"
        }
      ],
      "title": "net: fib_rules: Don\u0027t dump dying fib_rule in fib_rules_dump().",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74288",
    "datePublished": "2026-08-15T05:57:55.760Z",
    "dateReserved": "2026-08-15T05:44:03.881Z",
    "dateUpdated": "2026-08-17T05:45:27.821Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74288",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02942"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "include/net/fib_rules.h",
                  "net/core/fib_rules.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "0f929b59f4cd0e05bb1ecefe12b77e85911d4be2",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4b7ae30c81c2ee10a644749a3704a5c797ccc308",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2dfdc210d240bd48bb2ea746430b02b5571b6db9",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a7ef30753353ba6a95d693b1863a0214222a199a",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1fbc6c6efe78f4454a51afa0587efb6826f60f00",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "bb4a5b3c91af3c8d705bb2e9f6f8069a70db26fc",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3af0bc1bd9039e2e50abf3e2d7fee411f38bce4e",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2821e85c058f81c9948a2fb1a634f7b47457d51c",
                    "status": "affected",
                    "version": "5d7bfd141924a5ece21eb612ad3c56612f041c1e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "include/net/fib_rules.h",
                  "net/core/fib_rules.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.12"
                  },
                  {
                    "lessThan": "4.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: fib_rules: Don\u0027t dump dying fib_rule in fib_rules_dump().\n\nrocker_router_fib_event() calls fib_rule_get() during RCU dump.\n\nIf the fib_rule is dying, refcount_inc() will complain about it.\n\nLet\u0027s call refcount_inc_not_zero() in fib_rules_dump()."
          }
        ],
        "id": "CVE-2026-74288",
        "lastModified": "2026-08-17T06:19:22.723",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:28.343",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/0f929b59f4cd0e05bb1ecefe12b77e85911d4be2"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1fbc6c6efe78f4454a51afa0587efb6826f60f00"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2821e85c058f81c9948a2fb1a634f7b47457d51c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2dfdc210d240bd48bb2ea746430b02b5571b6db9"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3af0bc1bd9039e2e50abf3e2d7fee411f38bce4e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4b7ae30c81c2ee10a644749a3704a5c797ccc308"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a7ef30753353ba6a95d693b1863a0214222a199a"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/bb4a5b3c91af3c8d705bb2e9f6f8069a70db26fc"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T15:19:09+00:00",
      "cve": "CVE-2026-74288",
      "id": "CVE-2026-74288",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: fib_rules: Don\u0027t dump dying fib_rule in fib_rules_dump()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74288.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:23:23Z",
      "cve": "CVE-2026-74288",
      "id": "CVE-2026-74288",
      "initial_release_date": "2026-08-26T01:13:48Z",
      "product_status:known_affected": "356",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74288",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74288.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.