Description

In the Linux kernel, the following vulnerability has been resolved: nexthop: take nh->lock for f6i_list walks in replace check and notify fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info: BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799) Read of size 4 at addr ffff888014607e64 by task exploit/143 rt6_fill_node.isra.0 (net/ipv6/route.c:5799) fib6_rt_update (net/ipv6/route.c:6412) __nexthop_replace_notify (net/ipv4/nexthop.c:2542) rtm_new_nexthop (net/ipv4/nexthop.c:2554) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142 fib6_check_nh_list (net/ipv4/nexthop.c:1605) rtm_new_nexthop (net/ipv4/nexthop.c:2575) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076) Both walks only read the entries and take no tb6_lock, so protect them with nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC under the lock.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-15T13:18:01.690Z",
  "pubdate": "2026-08-15T13:18:01.690Z",
  "executiveSummary": "A concurrency vulnerability exists in the Linux kernel nexthop and IPv6 routing subsystems, specifically identified as a Use-After-Free (UAF) condition. The flaw manifests when performing walks of the nh->f6i_list within fib6_check_nh_list() and __nexthop_replace_notify() without holding the required nh->lock. Because IPv6 route operations such as RTM_NEWROUTE and RTM_DELROUTE execute without the RTNL lock and mutate the list under nh->lock, a race condition occurs. An attacker can exploit this concurrency bug to trigger concurrent route deletions that unlink and free a fib6_info structure while it is still being read, resulting in a slab-use-after-free scenario. This can lead to kernel crashes, denial of service, or potentially arbitrary code execution depending on system hardening and memory layout. The vulnerability affects Linux kernel systems utilizing IPv6 nexthop routing and requires local execution capabilities to trigger the netlink message sequences.",
  "technicalDetails": "The vulnerability resides in the Linux kernel networking subsystem handling of IPv6 nexthops, specifically within net/ipv4/nexthop.c and net/ipv6/route.c. The root cause is a synchronization flaw during nexthop replacement checks and notifications. Functions fib6_check_nh_list() and __nexthop_replace_notify() traverse the nh->f6i_list data structure during an RTNL-serialized nexthop replace operation without acquiring the necessary nh->lock.\nConcurrently, IPv6 route management operations like RTM_NEWROUTE and RTM_DELROUTE execute asynchronously relative to RTNL and mutate the same list under the protection of nh->lock via functions such as fib6_add_rt2node_nh() and fib6_purge_rt(). Because the read walks in the nexthop replacement and notification paths fail to acquire nh->lock, a race condition is established where a concurrent route delete operation unlinks and frees a fib6_info object while a thread is actively reading it.\nThe attack flow requires an actor to issue specific netlink messages to trigger nexthop replacement sequences concurrently with IPv6 route deletions. As demonstrated by KASAN debug reports, this race condition leads to a slab-use-after-free error when executing functions like rt6_fill_node.isra.0, fib6_rt_update(), or fib6_check_nh_list() when reading memory addresses associated with freed fib6_info structures.\nThe vulnerable components include the nexthop subsystem and IPv6 routing table management routines in the Linux kernel. Exploitation requires local execution context to send netlink commands, making it accessible to local unprivileged or privileged users depending on namespace configurations and network administration permissions. The post-exploitation impact includes kernel panics, denial of service, and potential memory corruption primitives useful for privilege escalation."
}