CVE-2026-74565

Consolidated sources describe CVE-2026-74565 affecting the Linux kernel netfilter nf_tables. The bug arises from a global rhltable for nft_object, enabling access to objects being disassembled from lookup paths across net namespaces and potentially causing use-after-free when nft_obj_destroy() re...

CVE-2026-74564 netfilter: xt_hashlimit: validate hashtable supports XT_HASHLIMIT_RATE_MATCH

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

CVE-2026-74564

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

EUVD-2026-59629

In the Linux kernel, the following vulnerability has been resolved: netfilter: xthashlimit: validate hashtable supports XTHASHLIMITRATEMATCH The XTHASHLIMITRATEMATCH flag mode changes the semantics of the dsthashent structure which represents an entry in the hashtable. There is a union area which...

CVE-2026-74562

The CVE-2026-74562 issue affects the Linux kernel nexthop code: fib6_check_nh_list() and __nexthop_replace_notify() walk the nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, while IPv6 RTM_NEWROUTE/RTM_DELROUTE can mutate that list without RTNL and race with ...

EUVD-2026-59627

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6ilist walks in replace check and notify fib6checknhlist and nexthopreplacenotify walk nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTMNEWROUTE/RTMDELROUTE run...

CVE-2026-74563

CVE-2026-74563 concerns the Linux kernel RDS TCP binding path. Ongoing code path in rds_tcp_laddr_check() looked up a scoped IPv6 interface with dev_get_by_index_rcu(), released the RCU read lock, and then passed the net_device into ipv6_chk_addr(). After rcu_read_unlock(), a concurrent RTM_DELLI...

CVE-2026-74563 rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

EUVD-2026-59628

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74563 rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check()

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74563

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74563

In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6chkaddr in rdstcpladdrcheck rdstcpladdrcheck looks up a scoped IPv6 interface with devgetbyindexrcu, drops the RCU read-side lock, and only then passes the bare struct netdevice into...

CVE-2026-74562 nexthop: take nh->lock for f6i_list walks in replace check and notify

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6ilist walks in replace check and notify fib6checknhlist and nexthopreplacenotify walk nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTMNEWROUTE/RTMDELROUTE run...

CVE-2026-74562

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6ilist walks in replace check and notify fib6checknhlist and nexthopreplacenotify walk nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTMNEWROUTE/RTMDELROUTE run...

CVE-2026-74562 nexthop: take nh->lock for f6i_list walks in replace check and notify

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh-lock for f6ilist walks in replace check and notify fib6checknhlist and nexthopreplacenotify walk nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock. IPv6 RTMNEWROUTE/RTMDELROUTE run...

CVE-2026-74561 nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

CVE-2026-74561

Summary: CVE-2026-74561 is a Linux kernel vulnerability where nh_rt_cache_flush walks an f6i_list without proper locking, racing with unlocked IPv6 route add/delete operations and freeing fib6_info. The fix migrates the sernum update to a broader netns scope by using rt_genid_bump_ipv6() instead ...

CVE-2026-74561

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

EUVD-2026-59626

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...

CVE-2026-74561 nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6ilist walk in nhrtcacheflush nhrtcacheflush walks nh-f6ilist during an RTNL-serialized nexthop replace without holding nh-lock, racing the unlocked IPv6 route add/delete that mutate the list under nh-loc...