CVE-2026-74583: Use-after-free in Linux route4 classifier

CVE-2026-74583 is a use-after-free vulnerability in the route4 classifier of the Linux kernel net/sched subsystem. The flaw affects a 16-slot fastmap cache that stores raw route4_filter structure pointers indexed by (id, iif). The race condition emerges when the reader (route4_classify) populates the cache while the writer (route4_delete, route4_change) clears it and queues kfree of the filter, causing stale pointers to be written into the cache before memory is freed.

The severity is confirmed by a CVSS score of 7.8 (High) and concrete technical evidence: two teams (ZDI and Santosh) reproduced the defect with KASAN slab-use-after-free reports and an mdelay(100) accelerator in route4_set_fastmap during concurrent add/delete stress tests. The GitHub signal on November 2, 2026 reports write-up, KASAN reproducer, and A/B evidence, indicating research has been documented and the kernel community confirmed the issue.

The mitigation deployed in the Linux kernel is the introduction of a per-filter boolean 'dying' flag that prevents in-flight readers from republishing stale fastmap entries after filter deletion. Linux sysadmins in production must update the kernel to the version that integrates this fix in their stable branch. Verify the patch in kernel changelogs and validate on staging before deployment. Enable KASAN monitoring for route4 fastmap alerts on test systems.