CVE-2026-74583

In the Linux kernel, the following vulnerability has been resolved:

net/sched: cls_route: fix fastmap use-after-free on filter

The route4 classifier maintains a 16-slot fastmap cache that stores raw

struct route4_filter pointers indexed by (id, iif). The reader

(route4_classify) populates this cache via route4_set_fastmap() for every

classified packet that hits a filter. The writer (route4_delete,

route4_change) clears the cache via route4_reset_fastmap() before

RCU-deferred kfree of the filter.

This creates a UAF race:

1. Reader walks the RCU-protected bucket chain, finds filter f

2. Writer unlinks f, calls route4_reset_fastmap(), then tcf_queue_work()

3. Reader calls route4_set_fastmap() and writes f into the cache

*after* the writer's reset, caching a pointer about to be freed

4. After the RCU grace period, kfree(f) executes

5. Next classified packet on the same (id, iif) tuple hits the stale

fastmap entry and reads f->res from freed memory

Reproduced with an mdelay(100) accelerator in route4_set_fastmap() and a

concurrent add/delete stress test (provided by both zdi and Santosh).

Both triggered KASAN slab-use-after-free reports in the route4 fastmap

paths.

Fix:

Introduce a per-filter boolean dying flag to suppress stale fastmap

republishing by in-flight readers.