CVE-2026-74630
ipv6: prevent in6_dev_get() from resurrecting inet6_dev
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The increment then resurrects an object whose RCU free has already been queued, so callers can use it after it is freed. Use refcount_inc_not_zero() and return NULL when the object has already reached zero. RCU keeps the memory accessible through the attempted reference acquisition, and a successful increment pins the object for the caller. An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3) kernel reproduced the invalid reference acquisition as UID 1000: refcount_t: addition on 0; use-after-free. ip6_mc_source+0xef4/0x17e0 It was followed by the corresponding reference underflow in ip6_mc_source(). The supplied trace from the same unpatched revision additionally shows the access after the RCU read-side section ends: BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0 Write of size 8 at addr ffff888015b50240 by task poc/1219 Bug found and triaged by OpenAI Security Research and validated by Trail of Bits.
INFO
Published Date :
Aug. 22, 2026, 4:16 p.m.
Last Modified :
Aug. 22, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products
The following products are affected by CVE-2026-74630
vulnerability.
Even if cvefeed.io is aware of the exact versions of the
products
that
are
affected, the information is not represented in the table below.
No affected product recoded yet
Solution
- Apply kernel patch that fixes in6_dev_get() behavior.
- Update your Linux kernel to the latest version.
- Reboot the system after kernel update.
- Verify the integrity of the updated kernel.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74630.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74630 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74630
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74630 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74630 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 22, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': '785d908f8d21c8bc78b6fb2c2932ab662bf6918a', 'versionType': 'git'}, {'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': 'aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8', 'versionType': 'git'}, {'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': '145812b678de9f3b59780173be3c0d22ed60dd93', 'versionType': 'git'}, {'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': 'cc5bd568f9b7683e60841b6fd02c10d64535bd6e', 'versionType': 'git'}, {'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': '1c206d461c680c3151daa3c89fc26eaf5bf98a7f', 'versionType': 'git'}, {'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': '680fbd7942185448eadb990a3d10a53eb946b702', 'versionType': 'git'}, {'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': '14e812ab41df0cac033479da835ec9a5de633404', 'versionType': 'git'}, {'status': 'affected', 'version': '8814c4b533817df825485ff32ce6ac406c3a54d1', 'lessThan': '0e243671bc7b8eaf00f83dd2f4367436dc0cff98', 'versionType': 'git'}], 'programFiles': ['include/net/addrconf.h'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.19'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.19', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.265', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.216', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['include/net/addrconf.h'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6_dev in6_dev_get() reads dev->ip6_ptr under RCU and then unconditionally increments its refcount. Device teardown can clear the pointer and drop the last reference between these operations. The increment then resurrects an object whose RCU free has already been queued, so callers can use it after it is freed. Use refcount_inc_not_zero() and return NULL when the object has already reached zero. RCU keeps the memory accessible through the attempted reference acquisition, and a successful increment pins the object for the caller. An independent run on the exact unpatched 6f5156d7a31a (v7.2-rc3) kernel reproduced the invalid reference acquisition as UID 1000: refcount_t: addition on 0; use-after-free. ip6_mc_source+0xef4/0x17e0 It was followed by the corresponding reference underflow in ip6_mc_source(). The supplied trace from the same unpatched revision additionally shows the access after the RCU read-side section ends: BUG: KASAN: slab-use-after-free in mutex_lock+0x76/0xe0 Write of size 8 at addr ffff888015b50240 by task poc/1219 Bug found and triaged by OpenAI Security Research and validated by Trail of Bits. Added Reference https://git.kernel.org/stable/c/0e243671bc7b8eaf00f83dd2f4367436dc0cff98 Added Reference https://git.kernel.org/stable/c/145812b678de9f3b59780173be3c0d22ed60dd93 Added Reference https://git.kernel.org/stable/c/14e812ab41df0cac033479da835ec9a5de633404 Added Reference https://git.kernel.org/stable/c/1c206d461c680c3151daa3c89fc26eaf5bf98a7f Added Reference https://git.kernel.org/stable/c/680fbd7942185448eadb990a3d10a53eb946b702 Added Reference https://git.kernel.org/stable/c/785d908f8d21c8bc78b6fb2c2932ab662bf6918a Added Reference https://git.kernel.org/stable/c/aedcfefdb5b7ed7f8a6196a3e68a25bdbe51d2f8 Added Reference https://git.kernel.org/stable/c/cc5bd568f9b7683e60841b6fd02c10d64535bd6e