What is the CVSS score of CVE-2026-74561?

CVE-2026-74561 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2026-74561?

A use-after-free race condition in the Linux kernel nexthop subsystem (CVE-2026-74561) allows local attackers with low-privilege access to achieve full kernel code execution, potentially compromising…. A patch is available.

How to fix or mitigate CVE-2026-74561?

Within 24 hours, acquire the vendor-released patch for your Linux kernel version and begin staging the update in your development environment. Within 7 days, deploy the patch to test infrastructure and evaluate deployment timeline for production systems based on business criticality. Within 30 days, complete rollout of the patched kernel across all production and non-production systems running vulnerable versions, prioritizing systems with local user access or container workloads.

Linux Kernel CVE-2026-74561

EUVD-2026-59626 HIGH

2026-08-15 Linux

GHSA-x2q4-hjx7-v4h6

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

7.8 HIGH

Race condition requires winning a narrow concurrent scheduling window, warranting AC:H over NVD's AC:L; all other metrics align with kernel UAF achieving scope change.

3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:26 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:28 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:28 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nexthop: avoid unlocked f6i_list walk in nh_rt_cache_flush

nh_rt_cache_flush() walks nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock, racing the unlocked IPv6 route add/delete that mutate the list under nh->lock and free fib6_info entries (nh_rt_cache_flush() is inlined into rtm_new_nexthop()):

BUG: KASAN: slab-use-after-free in nh_rt_cache_flush (net/ipv4/nexthop.c:2243) Read of size 8 at addr ffff888012953e18 by task exploit/146 nh_rt_cache_flush (net/ipv4/nexthop.c:2243) replace_nexthop (net/ipv4/nexthop.c:2610) rtm_new_nexthop (net/ipv4/nexthop.c:3323) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

Unlike the other f6i_list walks, this one bumps each route's sernum via fib6_update_sernum_upto_root(), which needs tb6_lock; taking nh->lock around it would invert the established tb6_lock -> nh->lock order and deadlock. As the only purpose is to invalidate cached dsts, bump the IPv6 sernum for the whole netns with rt_genid_bump_ipv6() instead, mirroring the rt_cache_flush() already done for IPv4 just above.

AnalysisAI

Use-after-free race condition in the Linux kernel nexthop subsystem (net/ipv4/nexthop.c) allows a local attacker with low-privilege access to trigger slab-use-after-free in kernel memory, potentially achieving full kernel code execution with scope change across the system. The race occurs between nh_rt_cache_flush() walking nh->f6i_list without holding nh->lock and concurrent IPv6 route add/delete operations freeing fib6_info entries under nh->lock - confirmed by an in-kernel KASAN trace naming the task 'exploit/146'. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Obtain local unprivileged shell access

Delivery

Create user/network namespace to gain CAP_NET_ADMIN

Exploit

Configure IPv6 nexthop object with associated fib6_info route entries

Execution

Simultaneously trigger nexthop replace (RTM_NEWNEIGHBOUR) and concurrent IPv6 route deletion

Persist

Win race between unlocked f6i_list walk and nh->lock-protected fib6_info free

Impact

Trigger slab-use-after-free for kernel code execution or denial of service

Access

Obtain local unprivileged shell access

Delivery

Create user/network namespace to gain CAP_NET_ADMIN

Exploit

Configure IPv6 nexthop object with associated fib6_info route entries

Execution

Simultaneously trigger nexthop replace (RTM_NEWNEIGHBOUR) and concurrent IPv6 route deletion

Persist

Win race between unlocked f6i_list walk and nh->lock-protected fib6_info free

Impact

Trigger slab-use-after-free for kernel code execution or denial of service

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local user account with the ability to perform RTM_NEWNEIGHBOUR nexthop replace netlink operations and concurrent IPv6 route mutations, which in practice requires CAP_NET_ADMIN within a network namespace. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H scores 8.8, reflecting that a low-privileged local attacker can reach the kernel networking subsystem with scope change and full C/I/A impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local user with a standard unprivileged account creates a user network namespace to gain CAP_NET_ADMIN, configures IPv6 nexthop objects with associated fib6_info route entries, then races two concurrent operations: one thread repeatedly issuing RTM_NEWNEIGHBOUR nexthop replace netlink messages (triggering nh_rt_cache_flush() and its unlocked f6i_list walk) while a second thread rapidly adds and deletes IPv6 routes attached to the same nexthop (freeing fib6_info entries under nh->lock). When the race window is won, nh_rt_cache_flush() reads from a freed fib6_info slab object - the KASAN trace in the CVE description (task named 'exploit/146', read at addr ffff888012953e18) confirms this path was triggered during vulnerability research. …
Remediation	Upgrade to a Linux kernel version incorporating the fix: Linux 7.1.8 or Linux 7.2-rc6 for the 7.x upstream series, or Linux 6.16 for the 6.x series, as confirmed by EUVD-2026-59626. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, acquire the vendor-released patch for your Linux kernel version and begin staging the update in your development environment. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-74561 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74561

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code