Answer in brief
CVE-2026-74563 records a High severity (CVSS 7.8) vulnerability in rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <b1d480fce05f857dc438080cd8c9244b84a83494 || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <8398bc477d3cb3e2b018a5aaac2bec0f69acda30 || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <78f75d632f74b8de0f081a128588f7c37d0d1164 | 76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef, f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff, b1d480fce05f857dc438080cd8c9244b84a83494, 8398bc477d3cb3e2b018a5aaac2bec0f69acda30, 78f75d632f74b8de0f081a128588f7c37d0d1164 |
| Linux/Linuxgeneric | 4.19 | Not reported |
| Linux/Linuxgeneric | >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <f8a8977af2134a1d91e5f9773cb7d9d53278c830 || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <ba95bce5dfe6e2ef602a87e0557225f2934ccb5c || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <c4933624a6f416ecfcc31ab58d585da1207a0597 || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <b1d480fce05f857dc438080cd8c9244b84a83494 || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <8398bc477d3cb3e2b018a5aaac2bec0f69acda30 || >=eee2fa6ab3225192d6d894c54a6fb02ac9efdff6 <78f75d632f74b8de0f081a128588f7c37d0d1164 | f8a8977af2134a1d91e5f9773cb7d9d53278c830, ba95bce5dfe6e2ef602a87e0557225f2934ccb5c, c4933624a6f416ecfcc31ab58d585da1207a0597, 76dd48886eeeb5fcf2b837d2f4c3d17eebeac9ef, f0d1fb05d70c8a561cd8d0473bcacafa2fc137ff, b1d480fce05f857dc438080cd8c9244b84a83494, 8398bc477d3cb3e2b018a5aaac2bec0f69acda30, 78f75d632f74b8de0f081a128588f7c37d0d1164 |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: rds: tcp: hold the RCU lock across ipv6_chk_addr() in rds_tcp_laddr_check() rds_tcp_laddr_check() looks up a scoped IPv6 interface with dev_get_by_index_rcu(), drops the RCU read-side lock, and only then passes the bare struct net_device * into ipv6_chk_addr(). dev_get_by_index_rcu() only keeps the device alive within the same RCU read-side section. After rcu_read_unlock(), a concurrent RTM_DELLINK can free the net_device; ipv6_chk_addr() then dereferences the stale pointer in __ipv6_chk_addr_and_flags() (e.g. l3mdev_master_dev_rcu(dev)), reading freed memory. Keep the RCU read-side lock held across the ipv6_chk_addr() call instead of dropping it right after the lookup, so the device cannot be freed while it is in use. BUG: KASAN: slab-use-after-free in __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998) Read of size 8 at addr ffff8880106ec000 by task exploit/153 Call Trace: ... kasan_report (mm/kasan/report.c:595) __ipv6_chk_addr_and_flags (... net/ipv6/addrconf.c:1998) ipv6_chk_addr (net/ipv6/addrconf.c:2031 net/ipv6/addrconf.c:1972) rds_tcp_laddr_check (net/rds/tcp.c:370) rds_bind (net/rds/bind.c:248) __sys_bind (net/socket.c:1920) __x64_sys_bind (net/socket.c:1956) do_syscall_64 (arch/x86/entry/syscall_64.c:63) entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Quoted source text, attributed separately from HOL analysis.