Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could allow a remote attacker to cause a system crash or potentially execute unauthorized actions. The issue occurs when the system processes specific types of IPv6 network traffic (Segment Routing and RPL) under high-load conditions on systems configured for real-time performance. This could lead to service instability or a complete system shutdown, impacting business operations and availability.
Technical details
A race condition exists in the Linux kernel's IPv6 implementation within the seg6_input_core() and rpl_input() functions. These functions call ip6_route_input(), which can set a non-reference-counted (NOREF) destination on a socket buffer (skb). On systems with PREEMPT_RT enabled, a high-priority task can preempt the softirq and release the underlying per-CPU route (pcpu_rt) before it is cached. This results in a use-after-free when dst_cache_set_ip6() later invokes dst_hold() on the now-freed destination. The vulnerability is triggered during concurrent FIB lookups on shared nexthops. Patches have been released to force a reference count on the destination before caching.
Affected products
- Linux Linux Kernel All versions prior to the May 2026 patches
Timeline
- 2026-04-21: other: Vulnerability fix authored
- 2026-05-07: patched: Patches committed to stable trees
- 2026-05-27: disclosed: CVE-2026-46099 published
References
- https://git.kernel.org/stable/c/52f9db67f8f35f436366cf4980b4f0a2583d0ef0
- https://git.kernel.org/stable/c/6bd17925bd6866027a6555db17905b9fc073d38d
- https://git.kernel.org/stable/c/9dd5481f960e337b81d7dfe429529495c1c481c0
- https://git.kernel.org/stable/c/b778b6d095421619c331fd2d7751143cd5387103
- https://git.kernel.org/stable/c/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e