Executive brief
A vulnerability was identified in the Linux kernel's IPv6 networking component, specifically affecting how it handles secure data encapsulation (XFRM). A flaw in the way the system processes certain network routing requests can lead to a memory leak. If an attacker sends a large volume of specifically crafted network packets, it could eventually exhaust system resources, potentially leading to a system crash or service outage.
Technical details
A reference count leak exists in net/ipv6/xfrm6_protocol.c within the xfrm6_rcv_encap() function. When the function performs an IPv6 route lookup using ip6_route_input_lookup(), it receives a referenced destination (dst) entry. If the lookup results in an error route (dst->error is set), the function drops the packet but fails to call dst_release(). An attacker can trigger this path repeatedly by sending packets that cause lookup failures, leading to the exhaustion of destination cache entries and eventual kernel instability. The issue has been resolved by ensuring dst_release() is called before jumping to the drop path.
Affected products
- Linux Linux Kernel Fixed in 5.10.217, 5.15.159, 6.1.91, 6.6.31, 6.8.10, 6.9.1
Timeline
- 2026-04-12: other: Patch authored
- 2026-05-28: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13
- https://git.kernel.org/stable/c/6a5eec0a2a0e99ec9743cf8f1c4082178811d90a
- https://git.kernel.org/stable/c/9d5047782f9bd2829e529df69209bf3232eb561f
- https://git.kernel.org/stable/c/bc0fcb9823cd0894934cf968b525c575833d7078
- https://git.kernel.org/stable/c/c2efc4956981066df2fef1cc77391b523db6d8e4