CVE-2026-64572: Linux kernel · ipv4: fib: free fib_alias with kfree_rcu() on insert error path
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f2f152e94a67bc746afaf05a1b2702c195553112 : patch Linux kernel soon.
Data as of 6 Nov 2026, 18:18 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in f2f152e94a67bc746afaf05a1b2702c195553112, d007056868723de9c0cc3f5ffaad47a8d468b9a4, cb8be318b4432abd88d3172ec157330f27a5f7a7 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 5 Aug 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix is available and has been applied in the Linux kernel source code as identified by multiple commit hashes. Users and administrators should update to a Linux kernel version that includes these fixes. No additional mitigation steps are indicated or required beyond applying the official patch.
Description
A use-after-free vulnerability exists in the IPv4 fib alias handling in the Linux kernel version 5.6. The issue occurs when fib_table_insert() publishes a new fib_alias into the leaf's fa_list, but if a notifier fails, the error path removes and immediately frees the fib_alias with kmem_cache_free(). Concurrent lookups under rcu_read_lock() may access this freed memory, causing a kernel slab-use-after-free bug. Exploiting this requires CAP_NET_ADMIN privileges and a registered fib notifier that can reject a route, such as a netdevsim device with exhausted IPv4 FIB resources. The vulnerability has been fixed by changing the free method to alias_free_mem_rcu(), which defers freeing safely under RCU. No public exploits are known.
References
- git.kernel.org/stable/c/9d0778571def598c31e84a38ae5a7ebc6f65e6d8 (opens in a new tab)
- git.kernel.org/stable/c/bb03350f974aec352b660d032a1d283eb462165a (opens in a new tab)
- git.kernel.org/stable/c/6429c9cfd941e62acd7bb0bc64d631574d4c3b2a (opens in a new tab)
- git.kernel.org/stable/c/8150b5365f026e72250cacc527ea00be30f40105 (opens in a new tab)
- git.kernel.org/stable/c/d007056868723de9c0cc3f5ffaad47a8d468b9a4 (opens in a new tab)
- git.kernel.org/stable/c/cb8be318b4432abd88d3172ec157330f27a5f7a7 (opens in a new tab)
- git.kernel.org/stable/c/b8d2ea75c76abcd0d72679c2f488271f573e32fb (opens in a new tab)
- git.kernel.org/stable/c/f2f152e94a67bc746afaf05a1b2702c195553112 (opens in a new tab)