{"id":7578,"date":"2026-09-04T18:49:36","date_gmt":"2026-09-04T10:49:36","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74563"},"modified":"2026-09-04T18:49:36","modified_gmt":"2026-09-04T10:49:36","slug":"cve-2026-74563","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-74563","title":{"rendered":"CVE-2026-74563 [HIGH] &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nrds: tcp: hold the RC"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()<\/p>\n<p>rds_tcp_laddr_check() looks up a scoped IPv6 interface with<br \/>\ndev_get_by_index_rcu(), drops the RCU read-side lock, and only then<br \/>\npasses the bare struct net_device * into ipv6_chk_addr().<\/p>\n<p>dev_get_by_index_rcu() only keeps the device alive within the same RCU<br \/>\nread-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can<br \/>\nfree the net_device; ipv6_chk_addr() then dereferences the stale pointer<br \/>\nin __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading<br \/>\nfreed memory.<\/p>\n<p>Keep the RCU read-side lock held across the ipv6_chk_addr() call instead<br \/>\nof dropping it right after the lookup, so the device cannot be freed<br \/>\nwhile it is in use.<\/p>\n<p>  BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (&#8230; net\/ipv6\/addrconf.c:1998)<br \/>\n  Read of size 8 at addr ffff8880106ec000 by task exploit\/153<br \/>\n  Call Trace:<br \/>\n   &#8230;<br \/>\n   kasan_report (mm\/kasan\/report.c:595)<br \/>\n   __ipv6_chk_addr_and_flags (&#8230; net\/ipv6\/addrconf.c:1998)<br \/>\n   ipv6_chk_addr (net\/ipv6\/addrconf.c:2031 net\/ipv6\/addrconf.c:1972)<br \/>\n   rds_tcp_laddr_check (net\/rds\/tcp.c:370)<br \/>\n   rds_bind (net\/rds\/bind.c:248)<br \/>\n   __sys_bind (net\/socket.c:1920)<br \/>\n   __x64_sys_bind (net\/socket.c:1956)<br \/>\n   do_syscall_64 (arch\/x86\/entry\/syscall_64.c:63)<br \/>\n   entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()<\/p>\n<p>rds_tcp_laddr_check() looks up a scoped IPv6 interface<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-7578","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/7578","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7578"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7578"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7578"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}