Linux Kernel: Four Networking and VM Vulnerabilities Disclosed Together on August 21, 2026
Four Linux kernel vulnerabilities impacting networking and virtual machine components were disclosed together on August 21, 2026, with resolutions available in updated kernel versions.
Key findings
- Four Linux kernel vulnerabilities disclosed on August 21, 2026, affecting networking and vhost components.
- CVE-2026-74583: Use-after-free in net/sched: cls_route due to fastmap cache issues.
- CVE-2026-74582: Inconsistent hard_header_len usage in packet subsystem during sends.
- CVE-2026-74581: IPv6 stack issue with clearing suppressed fib6 rule results.
- CVE-2026-74580: Vhost vring metadata cache not reset on reconfiguration.
- All disclosed vulnerabilities have been resolved in subsequent kernel updates.
On August 21, 2026, a batch of four vulnerabilities affecting the Linux kernel was disclosed. These vulnerabilities, all resolved on the same day, touch upon various networking and virtual machine components, highlighting the intricate nature of kernel security. The disclosures collectively underscore the importance of timely patching and vigilant monitoring of kernel updates for system administrators and security professionals.
One of the disclosed issues, CVE-2026-74583, addresses a use-after-free vulnerability within the net/sched: cls_route component. This flaw stemmed from the route4 classifier's fastmap cache, which stores pointers to struct route4_filter. A race condition could occur where the cache was populated, but a subsequent filter operation might attempt to access freed memory, potentially leading to instability or code execution.
CVE-2026-74582 focuses on the packet subsystem, specifically addressing an inconsistency in hard_header_len usage during non-ring send operations. The packet_snd() function accessed dev->hard_header_len multiple times. If the device configuration changed concurrently, such as during bonding device reconfiguration, this could lead to incorrect memory skb allocations and potential security implications.
In the IPv6 networking stack, CVE-2026-74581 identified an issue where the fib6_rule_suppress() function would drop a suppressed route but leave a dangling pointer in the result structure. This meant that subsequent lookups might still reference the released route information, even if no replacement rule was available, potentially causing unexpected routing behavior or information leaks.
Lastly, CVE-2026-74580 pertains to the vhost component, which is crucial for virtual machine networking. This vulnerability involved a failure to reset the vring metadata cache when vring reconfiguration occurred. The vq->meta_iotlb[] cache, used to store vhost_iotlb_map information, could retain stale data, leading iotlb_access_ok() to incorrectly assume a region was already mapped, potentially causing issues with I/O operations in virtualized environments.
All four vulnerabilities have been resolved in subsequent kernel releases. Users are advised to update to patched versions of the Linux kernel to mitigate these risks. The timely disclosure and resolution of these issues by the Linux kernel security team demonstrate a commitment to maintaining the integrity and security of the operating system.
This batch of disclosures serves as a reminder of the continuous effort required to secure complex systems like the Linux kernel. While these specific issues have been addressed, the dynamic nature of kernel development means that new vulnerabilities can emerge. Staying informed about security advisories and applying patches promptly remains the most effective defense against potential exploitation. The interconnectedness of the networking and virtualization components affected by these CVEs highlights the broad impact that kernel-level security flaws can have on system stability and data integrity.