CVE-2026-74581: net: ipv6: clear suppressed fib6 rule result

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: clear suppressed fib6 rule result

fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(),
but leaves res->rt6 pointing at the released rt6_info.

If no later rule supplies a replacement, fib6_rule_lookup() still sees
res.rt6 and returns that stale dst to its caller. A suppressing rule can
therefore leak a released route back to rt6_lookup(), and the next put
hits rcuref_put_slowpath() from dst_release().

Clear res->rt6 when suppressing the route so suppressed lookups fall
through to the null dst instead of reusing the released one.

The Linux kernel CVE team has assigned CVE-2026-74581 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.10.84 with commit 209d35ee34e25f9668c404350a1c86d914c54ffa and fixed in 5.10.265 with commit 90c57310e266eb94e4a80d6b15a9ca131d2e82cb
	Issue introduced in 5.15.7 with commit 8ef8a76a340ebdb2c2eea3f6fb0ebbed09a16383 and fixed in 5.15.216 with commit 5d29b286c9de0b309e94b9ed083aa1a2f429434f
	Issue introduced in 5.16 with commit cdef485217d30382f3bf6448c54b4401648fe3f1 and fixed in 6.1.183 with commit 354db6243eca59e9d187ffbf8b7955b044ce84dc
	Issue introduced in 5.16 with commit cdef485217d30382f3bf6448c54b4401648fe3f1 and fixed in 6.6.151 with commit 6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
	Issue introduced in 5.16 with commit cdef485217d30382f3bf6448c54b4401648fe3f1 and fixed in 6.12.103 with commit 9bad152c42b37499162367fe47867411e62fffa3
	Issue introduced in 5.16 with commit cdef485217d30382f3bf6448c54b4401648fe3f1 and fixed in 6.18.44 with commit dc3ab04220667f254f4348572b2a0b3febff89fb
	Issue introduced in 5.16 with commit cdef485217d30382f3bf6448c54b4401648fe3f1 and fixed in 7.1.8 with commit a341c091ca0bfae377747b1b59a3bd8ebe18a937
	Issue introduced in 5.16 with commit cdef485217d30382f3bf6448c54b4401648fe3f1 and fixed in 7.2 with commit 6aea62e433fe1b586202a5fee8b5807ce635e1d7
	Issue introduced in 5.4.164 with commit ee38eb8cf9a7323884c2b8e0adbbeb2192d31e29

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74581
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv6/fib6_rules.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/90c57310e266eb94e4a80d6b15a9ca131d2e82cb
	https://git.kernel.org/stable/c/5d29b286c9de0b309e94b9ed083aa1a2f429434f
	https://git.kernel.org/stable/c/354db6243eca59e9d187ffbf8b7955b044ce84dc
	https://git.kernel.org/stable/c/6d98c70fe0ba8c7708bfd5b2a5174d2086775daa
	https://git.kernel.org/stable/c/9bad152c42b37499162367fe47867411e62fffa3
	https://git.kernel.org/stable/c/dc3ab04220667f254f4348572b2a0b3febff89fb
	https://git.kernel.org/stable/c/a341c091ca0bfae377747b1b59a3bd8ebe18a937
	https://git.kernel.org/stable/c/6aea62e433fe1b586202a5fee8b5807ce635e1d7