{"id":11246,"date":"2026-09-04T18:53:06","date_gmt":"2026-09-04T10:53:06","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74656"},"modified":"2026-09-04T18:53:06","modified_gmt":"2026-09-04T10:53:06","slug":"cve-2026-74656","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74656","title":{"rendered":"CVE-2026-74656 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: fix use-after-f"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ipv4: fix use-after-free in fib_nhc_update_mtu()<\/p>\n<p>fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but<br \/>\nRTNL does not serialize this walk with PMTU exception updates. The walk<br \/>\nuses rcu_dereference_protected() with a constant true condition without<br \/>\nholding fnhe_lock.<\/p>\n<p>The following interleaving can therefore occur:<\/p>\n<p>  CPU 0                              CPU 1<br \/>\n  fib_nhc_update_mtu()               update_or_create_fnhe()<br \/>\n    load fnhe                          spin_lock_bh(&amp;fnhe_lock)<br \/>\n                                       fnhe_remove_oldest()<br \/>\n                                         unlink fnhe<br \/>\n                                         kfree_rcu(fnhe, rcu)<\/p>\n<p>    access fnhe after grace period<\/p>\n<p>KASAN reported:<\/p>\n<p>  BUG: KASAN: slab-use-after-free in fib_nhc_update_mtu+0x3df\/0x410<br \/>\n  Read of size 8 at addr ffff888107d49000 by task poc\/90<br \/>\n  Call Trace:<br \/>\n   fib_nhc_update_mtu+0x3df\/0x410<br \/>\n   fib_sync_mtu+0x7a\/0xd0<br \/>\n   fib_netdev_event+0x229\/0x3f0<br \/>\n   netif_set_mtu_ext+0x33a\/0x570<br \/>\n   dev_set_mtu+0x88\/0x120<\/p>\n<p>The same walk updates fnhe_pmtu and fnhe_mtu_locked. These fields form a<br \/>\npair and other writers serialize them with fnhe_lock. RCU alone prevents<br \/>\nreclamation, but would still allow concurrent writers to leave a mixed<br \/>\npair.<\/p>\n<p>Walk the table under RCU and acquire fnhe_lock only while updating each<br \/>\nexception. RCU keeps the current entry alive while the short critical<br \/>\nsection serializes its paired PMTU fields. This avoids holding the global<br \/>\nlock while scanning all 2048 buckets for every nexthop.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ipv4: fix use-after-free in fib_nhc_update_mtu()<\/p>\n<p>fib_nhc_update_mtu() walks the nexthop exception table under RTNL, but<br \/>\nRTNL does <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11246","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11246","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11246"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11246"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11246"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}