Vulnerability-Lookup

RHSA-2026:60438

Vulnerability from csaf_redhat - Published: 2026-08-27 07:51 - Updated: 2026-08-27 14:47

Summary

Red Hat Security Advisory: kernel-rt security update

Severity

Important

Notes

Topic: An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details: The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements. Security Fix(es): * kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer (CVE-2026-74581) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

CVE-2026-74581

A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6_rule_suppress(), when a route is suppressed and released via ip6_rt_put_flags(), the res->rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6_rule_lookup() returns the stale (freed) rt6_info to its caller. The subsequent dst_release() then operates on freed memory, hitting rcuref_put_slowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges.

7.8 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-416 - Use After Free

Affected products

Fixed 34 products

Product	Version	Remediation
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround
Unresolved product id: RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64	—	Vendor Fix fix Workaround

Threats

Impact Important

References

9 references

URL	Category
https://access.redhat.com/errata/RHSA-2026:60438	self
https://access.redhat.com/security/updates/classi…	external
https://bugzilla.redhat.com/show_bug.cgi?id=2520980	external
https://security.access.redhat.com/data/csaf/v2/a…	self
https://access.redhat.com/security/cve/CVE-2026-74581	self
https://bugzilla.redhat.com/show_bug.cgi?id=2520980	external
https://www.cve.org/CVERecord?id=CVE-2026-74581	external
https://nvd.nist.gov/vuln/detail/CVE-2026-74581	external
https://git.kernel.org/pub/scm/linux/kernel/git/t…	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for kernel-rt is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res-\u003ert6 pointer (CVE-2026-74581)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:60438",
        "url": "https://access.redhat.com/errata/RHSA-2026:60438"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2520980",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520980"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_60438.json"
      }
    ],
    "title": "Red Hat Security Advisory: kernel-rt security update",
    "tracking": {
      "current_release_date": "2026-08-27T14:47:54+00:00",
      "generator": {
        "date": "2026-08-27T14:47:54+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.16"
        }
      },
      "id": "RHSA-2026:60438",
      "initial_release_date": "2026-08-27T07:51:56+00:00",
      "revision_history": [
        {
          "date": "2026-08-27T07:51:56+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-27T07:51:56+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-27T14:47:54+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Real Time E4S (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux Real Time E4S (v.9.2)",
                  "product_id": "RT-9.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.2::realtime"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
                "product": {
                  "name": "Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
                  "product_id": "NFV-9.2.0.Z.E4S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_e4s:9.2::nfv"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Enterprise Linux"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
                "product": {
                  "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
                  "product_id": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@5.14.0-284.189.1.rt14.474.el9_2?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-core@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-core@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-devel@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules-core@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-modules-extra@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-devel@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules-core@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-modules-extra@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-debuginfo@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debuginfo-common-x86_64@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-debug-kvm@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                "product": {
                  "name": "kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_id": "kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/kernel-rt-kvm@5.14.0-284.189.1.rt14.474.el9_2?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)",
          "product_id": "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "NFV-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64 as a component of Red Hat Enterprise Linux Real Time E4S (v.9.2)",
          "product_id": "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        },
        "product_reference": "kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
        "relates_to_product_reference": "RT-9.2.0.Z.E4S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-74581",
      "cwe": {
        "id": "CWE-416",
        "name": "Use After Free"
      },
      "discovery_date": "2026-08-21T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2520980"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A use-after-free vulnerability was found in the Linux kernel\u0027s IPv6 FIB rule lookup path. In fib6_rule_suppress(), when a route is suppressed and released via ip6_rt_put_flags(), the res-\u003ert6 pointer is not cleared. If no later rule supplies a replacement route, fib6_rule_lookup() returns the stale (freed) rt6_info to its caller. The subsequent dst_release() then operates on freed memory, hitting rcuref_put_slowpath(). A local attacker who can configure IPv6 routing/FIB rules could trigger this to cause a denial of service (kernel crash) or potentially escalate privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res-\u003ert6 pointer",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
          "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
          "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
          "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-74581"
        },
        {
          "category": "external",
          "summary": "RHBZ#2520980",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2520980"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-74581",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-74581"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-74581",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74581"
        },
        {
          "category": "external",
          "summary": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7",
          "url": "https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6aea62e433fe1b586202a5fee8b5807ce635e1d7"
        }
      ],
      "release_date": "2026-08-21T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-27T07:51:56+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nThe system must be rebooted for this update to take effect.\n\nRed Hat recommends treating all kernel errata as security-relevant. Given the kernel\u0027s fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers\u0027 overall security posture.\n\nBecause of this proactive approach, a patch may be associated with a CVE assignment at a future date. Retroactive CVE assignments are always documented in the corresponding errata and on Red Hat\u0027s CVE pages. We strongly advise against delaying updates, as doing so may leave your system exposed when protections are already available.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:60438"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, disable the `ipv6` kernel module at boot using the kernel command-line parameter:\n\n```\ngrubby --update-kernel=ALL --args=\"ipv6.disable=1\"\n```\n\nA reboot is required for this change to take effect. To verify after reboot:\n\n```\ncat /proc/cmdline | grep -o ipv6.disable=1\nsysctl net.ipv6.conf.all.disable_ipv6\n```\n\nApplications or services that rely on the IPv6 protocol cannot use this mitigation and should prioritize applying the fix.",
          "product_ids": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
            "NFV-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-kvm-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "NFV-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.src",
            "RT-9.2.0.Z.E4S:kernel-rt-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debug-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-debuginfo-common-x86_64-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-devel-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-core-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64",
            "RT-9.2.0.Z.E4S:kernel-rt-modules-extra-0:5.14.0-284.189.1.rt14.474.el9_2.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res-\u003ert6 pointer"
    }
  ]
}

CVE-2026-74581 (GCVE-0-2026-74581)

Vulnerability from cvelistv5 – Published: 2026-08-21 16:31 – Updated: 2026-08-25 05:40

Title

net: ipv6: clear suppressed fib6 rule result

Summary

In the Linux kernel, the following vulnerability has been resolved: net: ipv6: clear suppressed fib6 rule result fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info. If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release(). Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/90c57310e266eb94e…
https://git.kernel.org/stable/c/5d29b286c9de0b309…
https://git.kernel.org/stable/c/354db6243eca59e9d…
https://git.kernel.org/stable/c/6d98c70fe0ba8c770…
https://git.kernel.org/stable/c/9bad152c42b374991…
https://git.kernel.org/stable/c/dc3ab04220667f254…
https://git.kernel.org/stable/c/a341c091ca0bfae37…
https://git.kernel.org/stable/c/6aea62e433fe1b586…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 209d35ee34e25f9668c404350a1c86d914c54ffa , < 90c57310e266eb94e4a80d6b15a9ca131d2e82cb (git) Affected: 8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383 , < 5d29b286c9de0b309e94b9ed083aa1a2f429434f (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 354db6243eca59e9d187ffbf8b7955b044ce84dc (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 9bad152c42b37499162367fe47867411e62fffa3 (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < dc3ab04220667f254f4348572b2a0b3febff89fb (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < a341c091ca0bfae377747b1b59a3bd8ebe18a937 (git) Affected: cdef485217d30382f3bf6448c54b4401648fe3f1 , < 6aea62e433fe1b586202a5fee8b5807ce635e1d7 (git) Affected: ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29 (git) Affected: 5.10.84 , < 5.10.265 (semver) Affected: 5.15.7 , < 5.15.216 (semver) Affected: 5.4.164 , < 5.5 (semver)
Linux	Linux	Affected: 5.16 Unaffected: 0 , < 5.16 (semver) Unaffected: 5.10.265 , ≤ 5.10.* (semver) Unaffected: 5.15.216 , ≤ 5.15.* (semver) Unaffected: 6.1.183 , ≤ 6.1.* (semver) Unaffected: 6.6.151 , ≤ 6.6.* (semver) Unaffected: 6.12.103 , ≤ 6.12.* (semver) Unaffected: 6.18.44 , ≤ 6.18.* (semver) Unaffected: 7.1.8 , ≤ 7.1.* (semver) Unaffected: 7.2 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/fib6_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "90c57310e266eb94e4a80d6b15a9ca131d2e82cb",
              "status": "affected",
              "version": "209d35ee34e25f9668c404350a1c86d914c54ffa",
              "versionType": "git"
            },
            {
              "lessThan": "5d29b286c9de0b309e94b9ed083aa1a2f429434f",
              "status": "affected",
              "version": "8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383",
              "versionType": "git"
            },
            {
              "lessThan": "354db6243eca59e9d187ffbf8b7955b044ce84dc",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "6d98c70fe0ba8c7708bfd5b2a5174d2086775daa",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "9bad152c42b37499162367fe47867411e62fffa3",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "dc3ab04220667f254f4348572b2a0b3febff89fb",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "a341c091ca0bfae377747b1b59a3bd8ebe18a937",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "lessThan": "6aea62e433fe1b586202a5fee8b5807ce635e1d7",
              "status": "affected",
              "version": "cdef485217d30382f3bf6448c54b4401648fe3f1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29",
              "versionType": "git"
            },
            {
              "lessThan": "5.10.265",
              "status": "affected",
              "version": "5.10.84",
              "versionType": "semver"
            },
            {
              "lessThan": "5.15.216",
              "status": "affected",
              "version": "5.15.7",
              "versionType": "semver"
            },
            {
              "lessThan": "5.5",
              "status": "affected",
              "version": "5.4.164",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/fib6_rules.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.16"
            },
            {
              "lessThan": "5.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.265",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.151",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.103",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.44",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.265",
                  "versionStartIncluding": "5.10.84",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.15.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.151",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.103",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.44",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.8",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.4.164",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: ipv6: clear suppressed fib6 rule result\n\nfib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),\nbut leaves res-\u003ert6 pointing at the released rt6_info.\n\nIf no later rule supplies a replacement, fib6_rule_lookup() still sees\nres.rt6 and returns that stale dst to its caller. A suppressing rule can\ntherefore leak a released route back to rt6_lookup(), and the next put\nhits rcuref_put_slowpath() from dst_release().\n\nClear res-\u003ert6 when suppressing the route so suppressed lookups fall\nthrough to the null dst instead of reusing the released one."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - fib6_rule_suppress() runs on every IPv6 route lookup via fib6_rule_lookup(), including ip6_route_input() for received packets and icmp6/icmpv6 redirect handlers; WireGuard/VPN servers commonly deploy suppress_prefixlength rules (wg-quick), so remote IPv6 traffic to those hosts reaches the bug.\nAC:L - Once suppress_prefixlength IPv6 policy routing rules exist, any matching packet deterministically triggers fib6_rule_suppress() to release the route while leaving a stale res-\u003ert6 pointer; no race or uncontrollable memory layout is required.\nPR:N - Remote exploitation needs only the ability to send IPv6 packets through a host whose operator already configured suppress rules (e.g., wg-quick); CAP_NET_ADMIN is an admin deployment prerequisite, not attacker privilege on the target.\nUI:N - No victim action is required beyond normal delivery of attacker-generated IPv6 traffic (or ICMPv6 redirect) to a host performing policy-route lookup.\nS:U - The stale rt6_info/dst_entry UAF corrupts kernel heap memory within the same host security boundary; it is not a VM escape or cross-authority sandbox break.\nC:H - Returning a released rt6_info leaves a dangling dst_entry in ip6_dst_cache; subsequent reads through ip6_dst_idev(), dst metrics, or error paths are classic slab UAF with attacker-influencable heap reuse via sustained IPv6 traffic.\nI:H - Double-free/imbalanced rcuref put and post-free use of rt6_info fields give heap corruption primitives; UAF on dst/route cache objects is routinely leveraged for kernel write and control-flow hijack.\nA:H - Commit explicitly reports rcuref_put_slowpath() WARN from dst_release() on the freed route; UAF and refcount corruption can oops/panic the kernel, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:40:07.594Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f"
        },
        {
          "url": "https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc"
        },
        {
          "url": "https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa"
        },
        {
          "url": "https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3"
        },
        {
          "url": "https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937"
        },
        {
          "url": "https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7"
        }
      ],
      "title": "net: ipv6: clear suppressed fib6 rule result",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74581",
    "datePublished": "2026-08-21T16:31:54.683Z",
    "dateReserved": "2026-08-15T05:44:03.918Z",
    "dateUpdated": "2026-08-25T05:40:07.594Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

RHSA-2026:60438

CVE-2026-74581 (GCVE-0-2026-74581)

Tags

Sightings

Nomenclature