Linux Kernel EUVD-2026-81704

Requires the kernel built with IPv6 multicast routing support (CONFIG_IPV6_MROUTE / ip6mr) AND an active multicast route daemon holding an mroute6_sk raw socket - configuring this needs CAP_NET_ADMIN, matching PR:L. Exploitation further requires a specific sequence and race: a multicast packet must miss MFC lookup and be queued as unresolved, the underlying route must be deleted and freed before the queue resolves, and resolution must occur with a wrong parent interface to reach the MRT6MSG_WRONGMIF report path. Local access is required (AV:L); there is no remote or unauthenticated vector, and the RCU/free timing window materially limits reliable exploitation.

The vendor CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) rates this a high-severity local privilege-required memory-corruption bug. I mostly agree on impact but dispute the complexity: the description is explicit that this is a use-after-free reachable only through a RACE ('escaping the receive-side RCU grace period', route 'deleted and freed', MFC queue 'later resolved with a wrong parent interface'). Winning that race window and arranging a WRONGMIF resolution against a freed dst is not deterministic, so AC:H is more honest than AC:L, lowering my score to roughly 7.0. The C:H/I:H/A:H claim is defensible because a slab UAF in the kernel can plausibly lead to information disclosure, corruption, or panic, though a crash/DoS is the most likely practical outcome. On exploitation signals: there is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - this is a fresh upstream fix with only kernel.org stable-commit references. Net: a legitimate memory-safety fix worth patching, but not an urgent widely-exploited threat; priority is driven by patch hygiene, not active exploitation. Note the input CWE is 'N/A' - this should be CWE-416 (use-after-free) with CWE-362 (race condition) as the root cause.

A local user with CAP_NET_ADMIN on a host with IPv6 multicast routing configured (an mroute6 raw socket) sends ingress multicast traffic that misses the MFC cache, queuing an skb with a non-refcounted dst onto the unresolved queue. The attacker then deletes the underlying route to free that dst and induces resolution with a wrong parent interface, causing ip6mr_cache_report() to dst_clone() the freed dst and trigger a slab use-after-free. No public exploit is identified at time of analysis; reliable exploitation requires winning the RCU/free race window.