CVE-2026-64572 (GCVE-0-2026-64572)

Vulnerability from cvelistv5 – Published: 2026-08-05 08:08 – Updated: 2026-08-19 16:28
VLAI
Title
ipv4: fib: free fib_alias with kfree_rcu() on insert error path
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias with kfree_rcu() on insert error path fib_table_insert() publishes new_fa into the leaf's fa_list with fib_insert_alias() before calling the fib entry notifiers. When a notifier fails, the error path removes new_fa with fib_remove_alias() (hlist_del_rcu) and frees it right away with kmem_cache_free(). fib_table_lookup() walks that list under rcu_read_lock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free: BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fib_table_lookup (net/ipv4/fib_trie.c:1601) ip_route_output_key_hash_rcu (net/ipv4/route.c:2814) ip_route_output_key_hash (net/ipv4/route.c:2705) __ip4_datagram_connect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64_sys_connect (net/socket.c:2173) do_syscall_64 entry_SYSCALL_64_after_hwframe which belongs to the cache ip_fib_alias of size 56 Triggering the error path needs CAP_NET_ADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough. Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already does for a fib_alias removed from the trie.
Severity
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < 9d0778571def598c31e84a38ae5a7ebc6f65e6d8 (git)
Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < bb03350f974aec352b660d032a1d283eb462165a (git)
Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < 6429c9cfd941e62acd7bb0bc64d631574d4c3b2a (git)
Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < 8150b5365f026e72250cacc527ea00be30f40105 (git)
Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < d007056868723de9c0cc3f5ffaad47a8d468b9a4 (git)
Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < cb8be318b4432abd88d3172ec157330f27a5f7a7 (git)
Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < b8d2ea75c76abcd0d72679c2f488271f573e32fb (git)
Affected: a6c76c17df021b141b0d306828c9fe4ba2d2717c , < f2f152e94a67bc746afaf05a1b2702c195553112 (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.6
Unaffected: 0 , < 5.6 (semver)
Unaffected: 5.10.265 , ≤ 5.10.* (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.148 , ≤ 6.6.* (semver)
Unaffected: 6.12.101 , ≤ 6.12.* (semver)
Unaffected: 6.18.42 , ≤ 6.18.* (semver)
Unaffected: 7.1.6 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_trie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9d0778571def598c31e84a38ae5a7ebc6f65e6d8",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "bb03350f974aec352b660d032a1d283eb462165a",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "6429c9cfd941e62acd7bb0bc64d631574d4c3b2a",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "8150b5365f026e72250cacc527ea00be30f40105",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "d007056868723de9c0cc3f5ffaad47a8d468b9a4",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "cb8be318b4432abd88d3172ec157330f27a5f7a7",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "b8d2ea75c76abcd0d72679c2f488271f573e32fb",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            },
            {
              "lessThan": "f2f152e94a67bc746afaf05a1b2702c195553112",
              "status": "affected",
              "version": "a6c76c17df021b141b0d306828c9fe4ba2d2717c",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/fib_trie.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.6"
            },
            {
              "lessThan": "5.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.101",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.42",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.148",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.101",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.42",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.6",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fib: free fib_alias with kfree_rcu() on insert error path\n\nfib_table_insert() publishes new_fa into the leaf\u0027s fa_list with\nfib_insert_alias() before calling the fib entry notifiers. When a\nnotifier fails, the error path removes new_fa with fib_remove_alias()\n(hlist_del_rcu) and frees it right away with kmem_cache_free().\n\nfib_table_lookup() walks that list under rcu_read_lock() only, so a\nconcurrent lookup that already reached new_fa keeps reading it after the\nfree:\n\n BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)\n Read of size 1 at addr ffff88810676d4eb by task exploit/297\n Call Trace:\n  fib_table_lookup (net/ipv4/fib_trie.c:1601)\n  ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)\n  ip_route_output_key_hash (net/ipv4/route.c:2705)\n  __ip4_datagram_connect (net/ipv4/datagram.c:49)\n  udp_connect (net/ipv4/udp.c:2144)\n  __sys_connect (net/socket.c:2167)\n  __x64_sys_connect (net/socket.c:2173)\n  do_syscall_64\n  entry_SYSCALL_64_after_hwframe\n which belongs to the cache ip_fib_alias of size 56\n\nTriggering the error path needs CAP_NET_ADMIN and a registered fib\nnotifier that can reject a route; a netdevsim device whose IPv4 FIB\nresource is exhausted is enough.\n\nFree new_fa with alias_free_mem_rcu(), as fib_table_delete() already\ndoes for a fib_alias removed from the trie."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-19T16:28:49.541Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9d0778571def598c31e84a38ae5a7ebc6f65e6d8"
        },
        {
          "url": "https://git.kernel.org/stable/c/bb03350f974aec352b660d032a1d283eb462165a"
        },
        {
          "url": "https://git.kernel.org/stable/c/6429c9cfd941e62acd7bb0bc64d631574d4c3b2a"
        },
        {
          "url": "https://git.kernel.org/stable/c/8150b5365f026e72250cacc527ea00be30f40105"
        },
        {
          "url": "https://git.kernel.org/stable/c/d007056868723de9c0cc3f5ffaad47a8d468b9a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/cb8be318b4432abd88d3172ec157330f27a5f7a7"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8d2ea75c76abcd0d72679c2f488271f573e32fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2f152e94a67bc746afaf05a1b2702c195553112"
        }
      ],
      "title": "ipv4: fib: free fib_alias with kfree_rcu() on insert error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64572",
    "datePublished": "2026-08-05T08:08:09.068Z",
    "dateReserved": "2026-07-19T15:36:31.797Z",
    "dateUpdated": "2026-08-19T16:28:49.541Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64572",
      "date": "2026-09-15",
      "epss": "0.00201",
      "percentile": "0.10218"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-09T01:42:53.000Z",
      "cve": "CVE-2026-64572",
      "id": "msrc_CVE-2026-64572",
      "initial_release_date": "2026-08-09T01:42:53.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ipv4: fib: free fib_alias with kfree_rcu() on insert error path",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64572.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64572\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-05T08:16:36.927\",\"lastModified\":\"2026-08-19T17:20:17.080\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nipv4: fib: free fib_alias with kfree_rcu() on insert error path\\n\\nfib_table_insert() publishes new_fa into the leaf\u0027s fa_list with\\nfib_insert_alias() before calling the fib entry notifiers. When a\\nnotifier fails, the error path removes new_fa with fib_remove_alias()\\n(hlist_del_rcu) and frees it right away with kmem_cache_free().\\n\\nfib_table_lookup() walks that list under rcu_read_lock() only, so a\\nconcurrent lookup that already reached new_fa keeps reading it after the\\nfree:\\n\\n BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)\\n Read of size 1 at addr ffff88810676d4eb by task exploit/297\\n Call Trace:\\n  fib_table_lookup (net/ipv4/fib_trie.c:1601)\\n  ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)\\n  ip_route_output_key_hash (net/ipv4/route.c:2705)\\n  __ip4_datagram_connect (net/ipv4/datagram.c:49)\\n  udp_connect (net/ipv4/udp.c:2144)\\n  __sys_connect (net/socket.c:2167)\\n  __x64_sys_connect (net/socket.c:2173)\\n  do_syscall_64\\n  entry_SYSCALL_64_after_hwframe\\n which belongs to the cache ip_fib_alias of size 56\\n\\nTriggering the error path needs CAP_NET_ADMIN and a registered fib\\nnotifier that can reject a route; a netdevsim device whose IPv4 FIB\\nresource is exhausted is enough.\\n\\nFree new_fa with alias_free_mem_rcu(), as fib_table_delete() already\\ndoes for a fib_alias removed from the trie.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/fib_trie.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"9d0778571def598c31e84a38ae5a7ebc6f65e6d8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"bb03350f974aec352b660d032a1d283eb462165a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"6429c9cfd941e62acd7bb0bc64d631574d4c3b2a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"8150b5365f026e72250cacc527ea00be30f40105\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"d007056868723de9c0cc3f5ffaad47a8d468b9a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"cb8be318b4432abd88d3172ec157330f27a5f7a7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"b8d2ea75c76abcd0d72679c2f488271f573e32fb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"a6c76c17df021b141b0d306828c9fe4ba2d2717c\",\"lessThan\":\"f2f152e94a67bc746afaf05a1b2702c195553112\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/fib_trie.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.6\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.6\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.265\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.148\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.101\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.42\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.6\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/6429c9cfd941e62acd7bb0bc64d631574d4c3b2a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/8150b5365f026e72250cacc527ea00be30f40105\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9d0778571def598c31e84a38ae5a7ebc6f65e6d8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b8d2ea75c76abcd0d72679c2f488271f573e32fb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bb03350f974aec352b660d032a1d283eb462165a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/cb8be318b4432abd88d3172ec157330f27a5f7a7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d007056868723de9c0cc3f5ffaad47a8d468b9a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f2f152e94a67bc746afaf05a1b2702c195553112\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-03T16:03:56+00:00",
      "cve": "CVE-2026-64572",
      "id": "CVE-2026-64572",
      "initial_release_date": "2026-08-05T00:00:00+00:00",
      "product_status:known_affected": "232",
      "product_status:known_not_affected": "42",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ipv4: fib: free fib_alias with kfree_rcu() on insert error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64572.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-15T01:45:25Z",
      "cve": "CVE-2026-64572",
      "id": "CVE-2026-64572",
      "initial_release_date": "2026-08-06T01:06:25Z",
      "product_status:first_fixed": "165",
      "product_status:known_affected": "614",
      "product_status:known_not_affected": "121",
      "product_status:recommended": "46",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64572",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64572.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.