EUVD-2026-59435
GHSA-mfph-jxq2-hg99
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Race condition requires precise timing between object teardown and RCU dump (AC:H); primary confirmed impact is kernel crash (A:H); marginal C:L/I:L reflects theoretical heap corruption potential without confirmed exploit chain.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().
rocker_router_fib_event() calls fib_rule_get() during RCU dump.
If the fib_rule is dying, refcount_inc() will complain about it.
Let's call refcount_inc_not_zero() in fib_rules_dump().
AnalysisAI
Concurrent use-after-free-adjacent race condition in the Linux kernel's FIB rules subsystem allows a local low-privileged user to trigger a kernel refcount complaint - and potentially a system crash or memory corruption - by racing a FIB rules dump against the teardown of a dying fib_rule object. Affected versions span multiple long-term stable branches from 4.12 onward through 7.x series kernels prior to the backported fix commits. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires local shell access with at minimum low-privilege credentials. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) rates this as high severity, but several signals warrant a more tempered real-world assessment. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A low-privileged local user with shell access on an affected kernel repeatedly issues netlink-based FIB rule dump requests (e.g., via rapid ip rule show calls or a custom netlink socket) while simultaneously triggering routing rule deletion on a system using the rocker driver. The concurrent teardown of a fib_rule object races against rocker_router_fib_event() calling fib_rule_get() during the dump, causing refcount_inc() to fire on a zeroed refcount and producing a kernel panic or WARN_ON splat, resulting in system unavailability. … |
| Remediation | The primary remediation is to upgrade to a patched Linux kernel version: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit Linux systems to identify kernel versions 4.12 through 7.x and document the scope of affected infrastructure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today