CVE-2026-64572

In the Linux kernel, the following vulnerability has been resolved:

ipv4: fib: free fibalias with kfreercu() on insert error path

fibtableinsert() publishes newfa into the leaf's falist with fibinsertalias() before calling the fib entry notifiers. When a notifier fails, the error path removes newfa with fibremovealias() (hlistdelrcu) and frees it right away with kmemcache_free().

fibtablelookup() walks that list under rcureadlock() only, so a concurrent lookup that already reached new_fa keeps reading it after the free:

BUG: KASAN: slab-use-after-free in fibtablelookup (net/ipv4/fibtrie.c:1601) Read of size 1 at addr ffff88810676d4eb by task exploit/297 Call Trace: fibtablelookup (net/ipv4/fibtrie.c:1601) iprouteoutputkeyhashrcu (net/ipv4/route.c:2814) iprouteoutputkey_hash (net/ipv4/route.c:2705) __ip4datagramconnect (net/ipv4/datagram.c:49) udp_connect (net/ipv4/udp.c:2144) __sys_connect (net/socket.c:2167) __x64sysconnect (net/socket.c:2173) dosyscall64 entrySYSCALL64afterhwframe which belongs to the cache ipfibalias of size 56

Triggering the error path needs CAPNETADMIN and a registered fib notifier that can reject a route; a netdevsim device whose IPv4 FIB resource is exhausted is enough.

Free newfa with aliasfreememrcu(), as fibtabledelete() already does for a fib_alias removed from the trie.