CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: free fib_alias with kfree_rcu() on insert error path

fib_table_insert() publishes new_fa into the leaf's fa_list with
fib_insert_alias() before calling the fib entry notifiers. When a
notifier fails, the error path removes new_fa with fib_remove_alias()
(hlist_del_rcu) and frees it right away with kmem_cache_free().

fib_table_lookup() walks that list under rcu_read_lock() only, so a
concurrent lookup that already reached new_fa keeps reading it after the
free:

 BUG: KASAN: slab-use-after-free in fib_table_lookup (net/ipv4/fib_trie.c:1601)
 Read of size 1 at addr ffff88810676d4eb by task exploit/297
 Call Trace:
  fib_table_lookup (net/ipv4/fib_trie.c:1601)
  ip_route_output_key_hash_rcu (net/ipv4/route.c:2814)
  ip_route_output_key_hash (net/ipv4/route.c:2705)
  __ip4_datagram_connect (net/ipv4/datagram.c:49)
  udp_connect (net/ipv4/udp.c:2144)
  __sys_connect (net/socket.c:2167)
  __x64_sys_connect (net/socket.c:2173)
  do_syscall_64
  entry_SYSCALL_64_after_hwframe
 which belongs to the cache ip_fib_alias of size 56

Triggering the error path needs CAP_NET_ADMIN and a registered fib
notifier that can reject a route; a netdevsim device whose IPv4 FIB
resource is exhausted is enough.

Free new_fa with alias_free_mem_rcu(), as fib_table_delete() already
does for a fib_alias removed from the trie.

The Linux kernel CVE team has assigned CVE-2026-64572 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.6 with commit a6c76c17df021b141b0d306828c9fe4ba2d2717c and fixed in 6.6.148 with commit 8150b5365f026e72250cacc527ea00be30f40105
	Issue introduced in 5.6 with commit a6c76c17df021b141b0d306828c9fe4ba2d2717c and fixed in 6.12.101 with commit d007056868723de9c0cc3f5ffaad47a8d468b9a4
	Issue introduced in 5.6 with commit a6c76c17df021b141b0d306828c9fe4ba2d2717c and fixed in 6.18.42 with commit cb8be318b4432abd88d3172ec157330f27a5f7a7
	Issue introduced in 5.6 with commit a6c76c17df021b141b0d306828c9fe4ba2d2717c and fixed in 7.1.6 with commit b8d2ea75c76abcd0d72679c2f488271f573e32fb
	Issue introduced in 5.6 with commit a6c76c17df021b141b0d306828c9fe4ba2d2717c and fixed in 7.2-rc4 with commit f2f152e94a67bc746afaf05a1b2702c195553112

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64572
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/fib_trie.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/8150b5365f026e72250cacc527ea00be30f40105
	https://git.kernel.org/stable/c/d007056868723de9c0cc3f5ffaad47a8d468b9a4
	https://git.kernel.org/stable/c/cb8be318b4432abd88d3172ec157330f27a5f7a7
	https://git.kernel.org/stable/c/b8d2ea75c76abcd0d72679c2f488271f573e32fb
	https://git.kernel.org/stable/c/f2f152e94a67bc746afaf05a1b2702c195553112