🟠 High | Source: Microsoft Security Response Center
CVE-2026-64572 is a Linux kernel vulnerability in the IPv4 Forwarding Information Base (FIB) routing subsystem, where a memory management flaw on an insert error path fails to correctly use kfree_rcu() to free a fib_alias structure. This type of use-after-free or improper memory release bug can potentially be exploited to cause system instability or, in certain conditions, arbitrary code execution. It is relevant to Azure as Microsoft has published an advisory, indicating that Azure infrastructure or Linux-based Azure services may be affected.
Security Architect’s Take: Review whether your Azure Linux VMs or AKS node pools are running kernel versions affected by this CVE and prioritise patching via Azure Update Manager or your node image upgrade pipeline. Monitor Microsoft’s MSRC advisory page for a CVSS score and patch availability, as the blast radius could extend to any Azure workload running a vulnerable Linux kernel.
Original advisory: CVE-2026-64572 ipv4: fib: free fib_alias with kfree_rcu() on insert error path