What is the CVSS score of CVE-2026-74562?

CVE-2026-74562 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Linux Kernel are affected by CVE-2026-74562?

A use-after-free vulnerability in the Linux kernel's IPv6 nexthop routing subsystem (CVE-2026-74562) enables low-privileged local users to corrupt kernel memory and potentially escalate privileges.. A patch is available.

How to fix or mitigate CVE-2026-74562?

Within 24 hours, identify all systems running vulnerable Linux kernel versions and verify IPv6 nexthop routing is in use. Within 7 days, validate vendor patches in a non-production environment and begin rolling out to development and testing systems. Within 30 days, deploy kernel patches to all production systems, starting with systems with IPv6 enabled, and reboot affected servers to activate the fixes. Coordinate patching with change management to minimize production impact.

Linux Kernel CVE-2026-74562

EUVD-2026-59627 HIGH

2026-08-15 Linux

GHSA-324p-252x-fjrc

Information Disclosure Linux Red Hat Suse

8.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

8.8 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

Local access required via rtnetlink; user namespaces lower PR to L; structural race window keeps AC:L; kernel scope change drives full C/I/A impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SUSE

7.0 HIGH

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Red Hat

5.5 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 12:27 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

8.8 (HIGH)

Patch available

Aug 15, 2026 - 13:04 EUVD

CVE Published

Aug 15, 2026 - 12:28 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 15, 2026 - 12:28 cve.org

HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

nexthop: take nh->lock for f6i_list walks in replace check and notify

fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list during an RTNL-serialized nexthop replace without holding nh->lock. IPv6 RTM_NEWROUTE/RTM_DELROUTE run without RTNL and mutate that list under nh->lock (fib6_add_rt2node_nh(), fib6_purge_rt()), so both walks race a concurrent route delete that unlinks and frees a fib6_info:

BUG: KASAN: slab-use-after-free in rt6_fill_node.isra.0 (net/ipv6/route.c:5799) Read of size 4 at addr ffff888014607e64 by task exploit/143 rt6_fill_node.isra.0 (net/ipv6/route.c:5799) fib6_rt_update (net/ipv6/route.c:6412) __nexthop_replace_notify (net/ipv4/nexthop.c:2542) rtm_new_nexthop (net/ipv4/nexthop.c:2554) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

BUG: KASAN: slab-use-after-free in fib6_check_nh_list (net/ipv4/nexthop.c:1605) Read of size 8 at addr ffff888014a7d068 by task exploit/142 fib6_check_nh_list (net/ipv4/nexthop.c:1605) rtm_new_nexthop (net/ipv4/nexthop.c:2575) rtnetlink_rcv_msg (net/core/rtnetlink.c:7076)

Both walks only read the entries and take no tb6_lock, so protect them with nh->lock; fib6_rt_update() uses gfp_any(), which returns GFP_ATOMIC under the lock.

AnalysisAI

Use-after-free in the Linux kernel's IPv6 nexthop routing subsystem allows a local low-privileged attacker to corrupt kernel memory by racing nexthop replace operations against concurrent IPv6 route deletion. The functions fib6_check_nh_list() and __nexthop_replace_notify() walk nh->f6i_list under RTNL serialization without holding nh->lock, while IPv6 route add/delete operations mutate that same list under nh->lock without RTNL, creating a window where a freed fib6_info struct is read. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon

Gain unprivileged local shell access

Delivery

Unshare into user namespace to acquire CAP_NET_ADMIN

Exploit

Configure IPv6 nexthop-linked routes on target interface

Install

Spawn concurrent thread issuing RTM_NEWNEXTHOP replace via rtnetlink

Race second thread issuing RTM_DELROUTE for same nexthop

Execute

Trigger fib6_info use-after-free in kernel walk

Impact

Read freed kernel memory or corrupt kernel structures for privilege escalation

Recon

Gain unprivileged local shell access

Delivery

Unshare into user namespace to acquire CAP_NET_ADMIN

Exploit

Configure IPv6 nexthop-linked routes on target interface

Install

Spawn concurrent thread issuing RTM_NEWNEXTHOP replace via rtnetlink

Race second thread issuing RTM_DELROUTE for same nexthop

Execute

Trigger fib6_info use-after-free in kernel walk

Impact

Read freed kernel memory or corrupt kernel structures for privilege escalation

Vulnerability AssessmentAI

Exploitation	Exploitation requires a local account on the target Linux system with the ability to send rtnetlink messages, which in kernel terms requires CAP_NET_ADMIN. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 8.8 score with Scope:Changed reflects full kernel compromise potential (C:H/I:H/A:H) reachable by local low-privileged users (AV:L/PR:L), making this particularly acute in multi-tenant Linux environments, container platforms, and cloud-hosted VMs where user namespace support grants CAP_NET_ADMIN to unprivileged processes. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	A local attacker with an unprivileged account on a system with user namespaces enabled creates a new user namespace to acquire CAP_NET_ADMIN, then spawns two concurrent threads: one repeatedly issues RTM_NEWNEXTHOP replace requests via rtnetlink to trigger f6i_list walks in fib6_check_nh_list() and __nexthop_replace_notify(), while a second thread simultaneously sends RTM_DELROUTE messages to delete IPv6 routes linked to the same nexthop object. The unsynchronized walk reads a fib6_info pointer that the deletion thread has already freed, producing a slab-use-after-free that can be leveraged to read kernel memory or redirect execution. …
Remediation	The primary fix is to update to Linux kernel 7.1.8 or apply the stable-tree fix commit 072cd1f21819dedd2252e704d255de3b0cfc61a7 (see https://git.kernel.org/stable/c/072cd1f21819dedd2252e704d255de3b0cfc61a7) for 7.1.x deployments, or fix commit bb2b072c619c1f741a6234257050f72005dc63ef (see https://git.kernel.org/stable/c/bb2b072c619c1f741a6234257050f72005dc63ef) for 6.16 series deployments. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, identify all systems running vulnerable Linux kernel versions and verify IPv6 nexthop routing is in use. …

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Important

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0	Not-Affected

CVE-2026-74562 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-74562

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code