CVE-2026-64572: ipv4: fib: free fib_alias with kfree_rcu() on insert error path

mediumCVSS 4.7CVE-2026-64572

CSIRTS triage

vendor: Linux product: Linux Kernel Memory corruption

What: The IPv4 FIB subsystem does not properly free fib_alias structures using kfree_rcu() on insertion error paths, leading to memory corruption.
Who is affected: Linux systems using IPv4 routing with certain network configurations that trigger insertion errors.
Urgency: Medium severity (CVSS 4.7); not currently exploited but memory corruption can cause system instability.
Action: Apply Linux kernel patch addressing proper kfree_rcu() handling in IPv4 FIB error paths.

AI-assisted analysis generated from the source advisory — verify against the original.

⚡ Watch Linux Kernel

Get an email when a new Linux Kernel advisory drops — max one per day, one-click unsubscribe.

Details

Source: Microsoft Security Response Center (INTL · vendor-psirt · site)
Severity: medium — CVSS 4.7
Published: 2026-08-11
Exploitation: Not in CISA KEV at last sync

Original advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-64572

Exploitation outlook

EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.

Low exploitation riskCVE-2026-645720.19% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 9% of all EPSS-scored CVEs.

Referenced CVEs

CVE	CSIRTS overview	External
CVE-2026-64572	coverage & exploitation status	NVD · CVE.org

Same CVEs, other sources

How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.

unknownMultiple vulnerabilities in Debian Linux kernel (August 14, 2026)cert-fr-avis
medium[UPDATE] [medium] Linux Kernel: Multiple vulnerabilitiescert-bund
unknownDSA-6415-1 linux - security updatedebian
unknownCVE-2026-64572: In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: free fib_alias …nvd

Recent advisories for ipv4

A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.

unknownCVE-2026-74289: In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't dump dyin…nvd · 2026-08-15
unknownCVE-2026-72421: In the Linux kernel, the following vulnerability has been resolved: ipv4: fib: Don't ignore er…nvd · 2026-08-15
unknownCVE-2026-72323: In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential …nvd · 2026-08-15
unknownCVE-2026-72321: In the Linux kernel, the following vulnerability has been resolved: ipv4: igmp: Fix potential …nvd · 2026-08-15
highCVE-2026-73629: Serendipity before 2.6.0 contains a server-side request forgery vulnerability in the serendipi…nvd · 2026-08-13
mediumCVE-2026-18728: A flaw was found in open-iscsi. An integer underflow vulnerability in the `iscsiuio` component…nvd · 2026-08-13