CVE-2026-74288

HighCVSS 7.8/10Last modified Oct 16, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: fib_rules: Don't dump dying fib_rule in fib_rules_dump().

rocker_router_fib_event() calls fib_rule_get() during RCU dump.

If the fib_rule is dying, refcount_inc() will complain about it.

Let's call refcount_inc_not_zero() in fib_rules_dump().

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < 0f929b59f4cd0e05bb1ecefe12b77e85911d4be2; >= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < 4b7ae30c81c2ee10a644749a3704a5c797ccc308; >= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < 2dfdc210d240bd48bb2ea746430b02b5571b6db9; >= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < a7ef30753353ba6a95d693b1863a0214222a199a; >= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < 1fbc6c6efe78f4454a51afa0587efb6826f60f00; >= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < bb4a5b3c91af3c8d705bb2e9f6f8069a70db26fc; >= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < 3af0bc1bd9039e2e50abf3e2d7fee411f38bce4e; >= 5d7bfd141924a5ece21eb612ad3c56612f041c1e, < 2821e85c058f81c9948a2fb1a634f7b47457d51c
LinuxLinux4.12

References

Timeline

Published
Aug 15, 2026
Last modified
Oct 16, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-742897.8In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dying fib_info in fib_leaf_notify(). syzbot repoCVE-2026-74294.6SSCMS v7.4.0 contains a reflected cross-site scripting vulnerability in the STL processing endpoint that allows attackers to execute arbitraCVE-2026-74290In the Linux kernel, the following vulnerability has been resolved: net/sched: cls_flow: Dont expose folded kernel pointers The flow classCVE-2026-74291In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objCVE-2026-742927.1In the Linux kernel, the following vulnerability has been resolved: ASoC: tegra: tegra210_ahub: Validate written enum value tegra_ahub_putCVE-2026-742937.8In the Linux kernel, the following vulnerability has been resolved: ASoC: fsl: fsl_audmix: Validate written enum values fsl_audmix_put_mixCVE-2026-742947.3In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internCVE-2026-742957.1In the Linux kernel, the following vulnerability has been resolved: ASoC: codecs: hdac_hdmi: Validate written enum value hdac_hdmi_set_pinCVE-2026-742967.8In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Release the HW‑provided UAR index rather than the SW one FrCVE-2026-742977.8In the Linux kernel, the following vulnerability has been resolved: RDMA/mlx5: Fix undefined shift of user RQ WQE size set_rq_size() compuCVE-2026-74298In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR set pinned push error path Add destruction of FRMRCVE-2026-74299In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix FRMR aging push to queue error flow Aging pools with pi
CVE-2026-74288: High severity, CVSS 7.8 | Vulnix