Executive brief
A vulnerability exists in the Linux kernel's IPv6 networking component, specifically within the In-situ Operations, Administration, and Maintenance (IOAM) feature. By sending a specially crafted network packet, an attacker can cause the system to crash or potentially execute unauthorized code. This could lead to a complete service outage or allow an attacker to gain control over the affected server.
Technical details
A heap buffer overflow exists in the Linux kernel's IPv6 IOAM implementation. The function `__ioam6_fill_trace_data()` trusts the `nodelen` field from incoming packets without verifying it against the `type` field (which defines the expected data items). An attacker can send a crafted packet with `nodelen=0` while setting specific type bits, causing the kernel to write approximately 100 bytes beyond the allocated buffer into `skb_shared_info`. This memory corruption typically results in a kernel panic (DoS) but could potentially be leveraged for further exploitation. The fix introduces `ioam6_trace_compute_nodelen()` to validate that the provided length matches the expected length derived from the trace type before processing.
Affected products
- Linux Linux Kernel 5.15 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-02-11: other: Vulnerability reported by researcher
- 2026-05-06: advisory: Initial CVE publication
- 2026-05-08: patched: Kernel.org updated with patch information
References
- https://git.kernel.org/stable/c/0591d6509c2ff13f09ea2998434aba0c0472e978
- https://git.kernel.org/stable/c/632d233cf2e64a46865ae2c064ae3c9df7c8864f
- https://git.kernel.org/stable/c/6db8b56eed62baacaf37486e83378a72635c04cc
- https://git.kernel.org/stable/c/e90346a2f1e8917d5760a44a1f61c44e3b36d96b
- https://git.kernel.org/stable/c/ea3632aefc04205436868541638e26f4a74d5637
- https://git.kernel.org/stable/c/f4d9d4b8fd839719d564651671e24c62c545c23b
- https://git.kernel.org/stable/c/fb3c662fafebc5b9d74417ed1de8759f6bb72143