CVE-2026-74583
net/sched: cls_route: fix fastmap use-after-free on filter
Description
In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter. This creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed 4. After the RCU grace period, kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths. Fix: Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers.
INFO
Published Date :
Aug. 21, 2026, 5:16 p.m.
Last Modified :
Oct. 16, 2026, 8:17 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Implement the 'dying' flag mechanism.
- Suppress stale fastmap republishing.
- Apply the kernel patch.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74583.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74583 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74583
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74583 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74583 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 16, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc Added Reference https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df Added Reference https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f Added Reference https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f Added Reference https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139 Added Reference https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1 Added Reference https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d Added Reference https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2 Removed Reference https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc Removed Reference https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df Removed Reference https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f Removed Reference https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f Removed Reference https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139 Removed Reference https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1 Removed Reference https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d Removed Reference https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 16, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-74583', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-10-16T19:01:17.964713Z'} -
CVE Translated by [email protected]
Oct. 14, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net/sched: cls_route: corrección de uso después de liberación de fastmap en el filtro El clasificador route4 mantiene una caché fastmap de 16 ranuras que almacena punteros brutos de struct route4_filter indexados por (id, iif). El lector (route4_classify) rellena esta caché a través de route4_set_fastmap() para cada paquete clasificado que coincide con un filtro. El escritor (route4_delete, route4_change) borra la caché a través de route4_reset_fastmap() antes de la liberación kfree diferida por RCU del filtro. Esto crea una condición de carrera UAF: 1. El lector recorre la cadena de cubos protegida por RCU, encuentra el filtro f 2. El escritor desvincula f, llama a route4_reset_fastmap(), luego tcf_queue_work() 3. El lector llama a route4_set_fastmap() y escribe f en la caché después del reinicio del escritor, almacenando en caché un puntero que está a punto de ser liberado 4. Después del período de gracia de RCU, se ejecuta kfree(f) 5. El siguiente paquete clasificado en la misma tupla (id, iif) accede a la entrada fastmap obsoleta y lee f -> res de memoria liberada Reproducido con un acelerador mdelay(100) en route4_set_fastmap() y una prueba de estrés concurrente de añadir/eliminar (proporcionada tanto por zdi como por Santosh). Ambos activaron informes de uso después de liberación de slab de KASAN en las rutas fastmap de route4. Solución: Introducir un indicador booleano 'dying' por filtro para suprimir la republicación de fastmap obsoleta por parte de lectores en curso. -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 25, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 21, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': '7897198b26445b4009a057bda1986b94a99e5d5f', 'versionType': 'git'}, {'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': '820f083c294ad6d319c02a7d43294f2ed2565139', 'versionType': 'git'}, {'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': '5ec9001be6d0eb527251125632ec8fe88278897f', 'versionType': 'git'}, {'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': 'b969984b2bdc85d721ce4047cd270cd37ec705a2', 'versionType': 'git'}, {'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': 'a17f636c9330eac879822ce29f998e5abd1b72c1', 'versionType': 'git'}, {'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': '0e7a8cf8895b06d07c7311f028eba16ad742b9bc', 'versionType': 'git'}, {'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': 'ae9aff87025219005a2d16b4fe83d6f24643e50d', 'versionType': 'git'}, {'status': 'affected', 'version': '1109c00547fc66df45b9ff923544be4c1e1bec13', 'lessThan': '47d7f7051253bdc02b1d245d87e38f16d31a74df', 'versionType': 'git'}], 'programFiles': ['net/sched/cls_route.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.18'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.18', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.265', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.216', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/sched/cls_route.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_route: fix fastmap use-after-free on filter The route4 classifier maintains a 16-slot fastmap cache that stores raw struct route4_filter pointers indexed by (id, iif). The reader (route4_classify) populates this cache via route4_set_fastmap() for every classified packet that hits a filter. The writer (route4_delete, route4_change) clears the cache via route4_reset_fastmap() before RCU-deferred kfree of the filter. This creates a UAF race: 1. Reader walks the RCU-protected bucket chain, finds filter f 2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work() 3. Reader calls route4_set_fastmap() and writes f into the cache *after* the writer's reset, caching a pointer about to be freed 4. After the RCU grace period, kfree(f) executes 5. Next classified packet on the same (id, iif) tuple hits the stale fastmap entry and reads f->res from freed memory Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a concurrent add/delete stress test (provided by both zdi and Santosh). Both triggered KASAN slab-use-after-free reports in the route4 fastmap paths. Fix: Introduce a per-filter boolean dying flag to suppress stale fastmap republishing by in-flight readers. Added Reference https://git.kernel.org/stable/c/0e7a8cf8895b06d07c7311f028eba16ad742b9bc Added Reference https://git.kernel.org/stable/c/47d7f7051253bdc02b1d245d87e38f16d31a74df Added Reference https://git.kernel.org/stable/c/5ec9001be6d0eb527251125632ec8fe88278897f Added Reference https://git.kernel.org/stable/c/7897198b26445b4009a057bda1986b94a99e5d5f Added Reference https://git.kernel.org/stable/c/820f083c294ad6d319c02a7d43294f2ed2565139 Added Reference https://git.kernel.org/stable/c/a17f636c9330eac879822ce29f998e5abd1b72c1 Added Reference https://git.kernel.org/stable/c/ae9aff87025219005a2d16b4fe83d6f24643e50d Added Reference https://git.kernel.org/stable/c/b969984b2bdc85d721ce4047cd270cd37ec705a2