CVE-2026-74630: In the Linux kernel, the following vulnerability has been resolved: ipv6: prevent in6_dev_get() from resurrecting inet6
Summary
A vulnerability in the Linux kernel's IPv6 code allows a freed object to be revived and used after it should have been destroyed. The problem occurs when in6_dev_get() reads a pointer and increments its reference counter (a count of how many parts of the system are using an object), but device shutdown can delete that pointer and drop the last reference between these two steps, causing the object to be resurrected after its memory has been queued for cleanup by RCU (read-copy-update, a synchronization mechanism that defers memory freeing).
Solution / Mitigation
Use refcount_inc_not_zero() (a function that only increments a reference counter if it is greater than zero) instead of unconditionally incrementing the refcount, and return NULL when the object has already reached zero. This ensures RCU keeps the memory accessible during the reference acquisition attempt, and a successful increment pins the object for the caller.
Vulnerability Details
EPSS: 0.0%
August 22, 2026
Classification
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-74630
First tracked: August 22, 2026 at 02:07 PM
Classified by LLM (prompt v3) · confidence: 95%