What is the CVSS score of CVE-2026-74581?

CVE-2026-74581 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by CVE-2026-74581?

A critical vulnerability affecting Linux kernel IPv6 routing (CVE-2026-74581, CVSS 9.8) can cause system crashes and data corruption on affected infrastructure.. A patch is available.

How to fix or mitigate CVE-2026-74581?

Within 24 hours: Identify Linux systems affected by this vulnerability using vendor guidance on vulnerable kernel versions and IPv6 configuration requirements. Within 7 days: Apply the vendor-released kernel patches to test environments and validate system stability, then schedule production rollout within your standard maintenance windows. Within 30 days: Verify successful patch deployment across all affected systems and update change logs to document this remediation.

Linux Kernel CVE-2026-74581

EUVD-2026-64003 CRITICAL

2026-08-21 Linux

GHSA-7ph7-58w3-w755

Information Disclosure Linux

9.8

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

5.9 MEDIUM

Trigger needs non-default IPv6 suppress FIB rules configured, so AC:H; realistic impact is a kernel-crash use-after-free (A:H) with no confirmed confidentiality/integrity effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 25, 2026 - 08:31 vuln.today

CVSS changed

Aug 25, 2026 - 06:22 NVD

9.8 (CRITICAL)

Patch available

Aug 21, 2026 - 17:16 EUVD

CVE Published

Aug 21, 2026 - 16:31 cve.org

CRITICAL 9.8

CVE Published

Aug 21, 2026 - 16:31 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: clear suppressed fib6 rule result

fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info.

If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release().

Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.

AnalysisAI

Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Host runs IPv6 suppress FIB rule

Delivery

Traffic triggers rt6_lookup route resolution

Exploit

Suppress rule frees route, leaves stale res.rt6

Execution

Stale released dst returned to caller

Persist

dst_release drops ref on freed memory

Impact

Kernel use-after-free crash (DoS)

Access

Host runs IPv6 suppress FIB rule

Delivery

Traffic triggers rt6_lookup route resolution

Exploit

Suppress rule frees route, leaves stale res.rt6

Execution

Stale released dst returned to caller

Persist

dst_release drops ref on freed memory

Impact

Kernel use-after-free crash (DoS)

Vulnerability AssessmentAI

Exploitation	Requires the target system to run IPv6 and to have a policy-routing FIB rule with a suppress action configured (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The signals conflict and should be reconciled before prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	On a router or host configured with IPv6 policy routing that includes a suppress rule, an attacker (or ordinary traffic) triggers an IPv6 route lookup whose best candidate is suppressed with no later rule providing a replacement. The lookup returns the just-freed dst, and the following dst_release() dereferences freed memory, panicking the kernel or corrupting the dst slab. …
Remediation	Vendor-released patch: upgrade to a fixed stable release for your branch - 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, or 7.1.8/7.2 as applicable - which add the res->rt6 clear in fib6_rule_suppress(). … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify Linux systems affected by this vulnerability using vendor guidance on vulnerable kernel versions and IPv6 configuration requirements. …

Threat intelligence, references, and detailed analysis are available after sign-in.