Description

In the Linux kernel, the following vulnerability has been resolved: nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()): BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243) Read of size 8 at addr ffff888012953e18 by task exploit/146 nh_rt_cache_flush (net/ipv4/nexthop.c:2243) replace_nexthop (net/ipv4/nexthop.c:2610) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) Unlike the other f6i_list walks, this one bumps each route's sernum via fib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock around it would invert the established tb6_lock -> nh->lock order and deadlock. As the only purpose is to invalidate cached dsts, bump the IPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead, mirroring the rt_cache_flush() already done for IPv4 just above.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:18:01.590Z",
  "pubdate": "2026-08-15T13:18:01.590Z",
  "executiveSummary": "A use-after-free vulnerability exists in the Linux kernel nexthop subsystem, specifically within the nh_rt_cache_flush() function located in net/ipv4/nexthop.c.\nThe vulnerability arises due to a race condition caused by an unlocked traversal of the f6i_list during a netlink-serialized nexthop replacement operation, while concurrent IPv6 route additions or deletions mutate the list and free fib6_info entries without proper synchronization under the nh->lock.\nThis flaw can be exploited by a local attacker to trigger a slab-use-after-free condition, leading to potential kernel memory corruption, denial of service (kernel panic), or theoretically arbitrary code execution depending on kernel hardening configurations and heap layout.\nThe affected component is the Linux kernel networking stack, specifically the nexthop and IPv6 routing subsystems.\nExploitation requires the ability to execute code locally on the target system with sufficient privileges to issue netlink messages and manipulate network routes, or via container environments with administrative network capabilities.",
  "technicalDetails": "The root cause of the vulnerability resides in the synchronization gap within nh_rt_cache_flush() in net/ipv4/nexthop.c. When executing a nexthop replacement via rtm_new_nexthop() and subsequently replace_nexthop(), the kernel invokes nh_rt_cache_flush() to iterate over the f6i_list associated with a nexthop structure (nh->f6i_list).\nUnlike other traversals of f6i_list that safely acquire the nh->lock, nh_rt_cache_flush() attempted to walk the list without holding nh->lock. This was done to avoid a lock inversion scenario between the established locking hierarchy of tb6_lock and nh->lock, which would occur if it attempted to acquire locks while bumping each route's sernum via fib6_update_sernum_upto_root().\nDuring this unlocked traversal, concurrent asynchronous IPv6 route addition or deletion operations can mutate the f6i_list and free fib6_info entries. Because the traversal in nh_rt_cache_flush() lacks the necessary locking protection, a thread can read and dereference pointers to fib6_info structures that have already been deallocated by a concurrent thread, resulting in a slab-use-after-free condition.\nThe execution flow involves the attacker issuing a crafted netlink message processed by rtnetlink_rcv_msg(), which triggers rtm_new_nexthop(). This calls replace_nexthop(), inlining nh_rt_cache_flush() to walk the vulnerable f6i_list. A race condition is established when a concurrent thread modifies IPv6 routes, freeing the memory pointed to by the walker. The KASAN report confirms a read of size 8 at address ffff888012953e18 by an exploit task during the nh_rt_cache_flush execution.\nThe impact of this race condition includes kernel crashes manifesting as slab-use-after-free bugs, potential denial of service, and memory corruption within the kernel slab allocator. The vulnerability impacts local users or processes capable of interacting with the rtnetlink socket interface to modify network nexthops and routing tables."
}