Executive brief
A vulnerability was identified in the Linux kernel's IPv6 networking component. The kernel is the core software that manages a computer's hardware and basic operations. This specific issue could allow a local user to cause a system crash or instability by sending specially crafted network routing commands, potentially leading to a denial of service.
Technical details
An out-of-bounds (OOB) read vulnerability exists in net/ipv6/ip6_fib.c within the fib6_add_rt2node() function. The issue occurs when an IPv6 route is created using RTA_NH_ID; in this configuration, the fib6_info structure does not contain the expected trailing fib6_nh structure. The kernel previously attempted to access iter->fib6_nh->fib_nh_gw_family without verifying if the nexthop (nh) pointer was valid, leading to a slab-out-of-bounds read as reported by KASAN. An attacker with local privileges to manipulate network routes (e.g., via Netlink) could trigger this OOB read to cause a kernel oops or denial of service. Patches have been released for various stable branches including 6.1.y, 6.6.y, 6.12.y, and 6.13.y.
Affected products
- Linux Linux Kernel 6.1, 6.6, 6.12, 6.13
Timeline
- 2026-02-11: patched: Initial fix authored by Kuniyuki Iwashima
- 2026-06-03: advisory: CVE-2026-46260 published by NVD
References
- https://git.kernel.org/stable/c/03b5051e02f5a3772eee57493ad697d4b505b0c2
- https://git.kernel.org/stable/c/500e54615c97bc3c427e52305a6fcd38a0e008a3
- https://git.kernel.org/stable/c/8244f959e2c125c849e569f5b23ed49804cce695
- https://git.kernel.org/stable/c/bcc60ad129ae1837cf809c81bff56ec8bfdb6b11
- https://git.kernel.org/stable/c/bf5009a06e03ee9a51052bb59f2228a5e4e66260