{
  "cveId": "CVE-2026-74561",
  "url": "https://patchblox.com/security/cve/CVE-2026-74561",
  "summary": "CVE-2026-74561 is fixed in linux on 1 platform by DEBIAN-CVE-2026-74561 (version 7.1.8-1), released August 16, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  nexthop: avoid unlocked f6i_list walk in nh_rt_c...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush  nh_rt_cache_flush() walks nh-\u003Ef6i_list during an RTNL-serialized nexthop replace without holding nh-\u003Elock, racing the unlocked IPv6 route add/delete that mutate the list under nh-\u003Elock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):    BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243)   Read of size 8 at addr ffff888012953e18 by task exploit/146    nh_rt_cache_flush (net/ipv4/nexthop.c:2243)    replace_nexthop (net/ipv4/nexthop.c:2610)    rtm_new_nexthop (net/ipv4/nexthop.c:3323)    rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)  Unlike the other f6i_list walks, this one bumps each route\u0027s sernum via fib6_update_sernum_upto_root(), which needs tb6_lock; taking nh-\u003Elock around it would invert the established tb6_lock -\u003E nh-\u003Elock order and deadlock. As the only purpose is to invalidate cached dsts, bump the IPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead, mirroring the rt_cache_flush() already done for IPv4 just above.",
  "published": "2026-08-15T13:18:01Z",
  "severity": "high",
  "cvss": 8.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
  "epss": 0.00115,
  "epssPercentile": 0.01569,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.8-1",
      "fix": "DEBIAN-CVE-2026-74561",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-74561",
      "released": "2026-08-16T22:48:20Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}