CVE-2026-74398 | In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failu
In the Linux kernel, the following vulnerability has been resolved:
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD
via addrconf_dad_end(), which drops ifp->lock on return. The lock
is re-acquired after net_info_ratelimited(). A concurrent
ipv6_del_addr() can take the lock in that window, set ifp->state
to DEAD and run list_del_rcu(&ifp->if_list).
addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad:
and schedules a new dad_work. The work calls ipv6_del_addr()
again, hitting the already-poisoned list entry:
general protection fault: 0000 [#1] SMP NOPTI
CPU: 4 PID: 217 Comm: kworker/4:1
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:ipv6_del_addr+0xe9/0x280
RAX: dead000000000122
Call Trace:
addrconf_dad_stop+0x113/0x140
addrconf_dad_work+0x28c/0x430
process_one_work+0x1eb/0x3b0
worker_thread+0x4d/0x400
kthread+0x104/0x140
ret_from_fork+0x35/0x40
Fold the addrconf_dad_end() logic into addrconf_dad_failure() under
a single ifp->lock critical section. The STABLE_PRIVACY branch
temporarily drops ifp->lock around address regeneration, so at
lock_errdad: verify the state is still POSTDAD before transitioning
to ERRDAD; bail out otherwise to avoid overwriting a state set by
another path while the lock was released.
- 🔗 git.kernel.org/stable/c/47b05836705b63dab93d9ac7c69a3a50…
- 🔗 git.kernel.org/stable/c/d21be7d051012c6b572fa4e3334443c2…
- 🔗 git.kernel.org/stable/c/875c284c0f98b042bb97abad460f63a2…
- 🔗 git.kernel.org/stable/c/8ed0ce9ea58d677d1bac92614ee5f60f…
- 🔗 git.kernel.org/stable/c/3bdc86d89fd6c6523753fa6f42fcfaf3…
- 🔗 git.kernel.org/stable/c/b61af0268e3d1308c466bf0be5dced84…
- 🔗 git.kernel.org/stable/c/e889aa99ad3ed48bb0ddcff6475b1754…
- 🔗 git.kernel.org/stable/c/627ac78f2741e2ebd2225e2e953b6964…
```Code``` unterstützt. Zero-Day & Vulnerability Intelligence Hub
Echtzeit-Tracking mit EPSS Exploit-Wahrscheinlichkeiten, Angriffsvektor-Decodern und KI-Patch-Anleitungen.
📊 Historien-Charts — Criticals-Trend · Vendors · EPSS-Verteilung
| Tier | CVEs | Anteil |
|---|---|---|
| ≥90 % | 723 | 0,2 % |
| ≥50 % | 3.221 | 0,9 % |
| ≥10 % | 22.089 | 5,9 % |
| <10 % | 346.221 | 93,0 % |
Noch keine Analyse zu CVE-2026-74398
Sei der Erste: Einschätzung, Betroffenheit, Workaround oder PoC — mit Antworten im Thread.