{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.180-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.100-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.1.5-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD  addrconf_dad_failure() transitions ifp-\u003estate from DAD to POSTDAD via addrconf_dad_end(), which drops ifp-\u003elock on return.  The lock is re-acquired after net_info_ratelimited().  A concurrent ipv6_del_addr() can take the lock in that window, set ifp-\u003estate to DEAD and run list_del_rcu(\u0026ifp-\u003eif_list).  addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work.  The work calls ipv6_del_addr() again, hitting the already-poisoned list entry:    general protection fault: 0000 [#1] SMP NOPTI   CPU: 4 PID: 217 Comm: kworker/4:1   Workqueue: ipv6_addrconf addrconf_dad_work   RIP: 0010:ipv6_del_addr+0xe9/0x280   RAX: dead000000000122   Call Trace:    addrconf_dad_stop+0x113/0x140    addrconf_dad_work+0x28c/0x430    process_one_work+0x1eb/0x3b0    worker_thread+0x4d/0x400    kthread+0x104/0x140    ret_from_fork+0x35/0x40  Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp-\u003elock critical section.  The STABLE_PRIVACY branch temporarily drops ifp-\u003elock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released.",
  "id": "DEBIAN-CVE-2026-74398",
  "modified": "2026-09-14T16:47:33.227591452Z",
  "published": "2026-08-15T06:22:41.790Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-74398"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-74398"
  ]
}