The Linux kernel contained a use-after-free vulnerability in the fib_nhc_update_mtu() function, which walks the nexthop exception table under RTNL without proper serialization against PMTU exception updates. The function used rcu_dereference_protected() with a constant true condition but did not hold the required fnhe_lock, allowing a race condition where an entry could be freed and accessed concurrently. This was detected by KASAN as a slab-use-after-free error. The vulnerability was addressed by modifying the code to walk the table under RCU and acquire fnhe_lock only during updates of paired PMTU fields, preventing concurrent writers from leaving inconsistent state and avoiding holding a global lock during the scan.

This vulnerability allows a use-after-free condition in kernel memory, which can lead to memory corruption and potential instability or crashes in the kernel. There is no information about active exploitation in the wild. The impact is limited to kernel memory safety and could potentially be leveraged for privilege escalation or denial of service if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The description indicates the vulnerability has been resolved in the Linux kernel, so applying the official kernel updates when available is recommended. No specific temporary mitigations are provided.