Skip to content
Heist/ feed
High

ipv6: prevent in6_dev_get() from resurrecting inet6_dev

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The increment then resurrects an object whose RCU free has already been queued, so callers can use it after it is freed. Use refcount_inc_not_zero() and return NULL when the object has already reached zero. RCU keeps the memory accessible through the attempted reference acquisition, and a successful increment pins the object for the caller. An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3) kernel reproduced the invalid reference acquisition as UID 1000: refcount_t: addition on 0; use-after-free. ip6_mc_source+0xef4/0x17e0 It was followed by the corresponding reference underflow in ip6_mc_source(). The supplied trace from the same unpatched revision additionally shows the access after the RCU read-side section ends: BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0 Write of size 8 at addr ffff888015b50240 by task poc/1219 Bug found and triaged by OpenAI Security Research and validated by Trail of Bits.

Announced Source revision 1
Original source ↗

CVE-2026-74630

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-74630

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "785d908f8d21c8bc78b6fb2c2932ab662bf6918a",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "145812b678de9f3b59780173be3c0d22ed60dd93",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "cc5bd568f9b7683e60841b6fd02c10d64535bd6e",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "1c206d461c680c3151daa3c89fc26eaf5bf98a7f",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "680fbd7942185448eadb990a3d10a53eb946b702",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "14e812ab41df0cac033479da835ec9a5de633404",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "8814c4b533817df825485ff32ce6ac406c3a54d1",
        "lessThan": "0e243671bc7b8eaf00f83dd2f4367436dc0cff98",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "include/net/addrconf.h"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "2.6.19"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "2.6.19",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.265",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.216",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.183",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.152",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.104",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.45",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.9",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "include/net/addrconf.h"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-74630

Source reference: /cveMetadata/cveId

Publisher severity

high

Source reference: /containers/cna/metrics

Event
#34250 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement