CVE-2026-74496

In the Linux kernel, the following vulnerability has been resolved:

fou: Fix use-after-free in fou_create()

foucreate() publishes struct fou through skuserdata before adding the new FOU port to the per-netns list. If fouaddtoportlist() fails, the error path frees fou while it is still reachable through skuserdata. A concurrent receive can then dereference the freed object in foufrom_sock().

This ordering issue was previously noted in the linked discussion.

The failure is reachable when local port 0 is requested. Each socket binds to a different ephemeral port, but foucfgcmp() compares the requested port 0 and reports -EALREADY once an entry already exists.

Release the tunnel socket before freeing fou so skuserdata is cleared first, and defer reclamation with kfreercu() to protect concurrent RCU readers. This matches the lifetime handling in fourelease().