Executive brief
A vulnerability in the Linux kernel's networking component could lead to a memory leak. When the system attempts to transmit data over a network protocol that is disabled or uninitialized (such as IPv6), the kernel fails to properly clean up internal data buffers. Over time, this could consume system memory, potentially leading to performance degradation or a system crash.
Technical details
A memory leak exists in the net/core/neighbour.c component of the Linux kernel. The neigh_xmit() function is designed to take ownership of socket buffers (skb) and either transmit or free them. However, a specific code path triggered when a neighbor table is uninitialized (e.g., NEIGH_ND_TABLE when IPv6 is disabled) returns -EAFNOSUPPORT without freeing the skb. Because callers of neigh_xmit often ignore the return value and assume the buffer has been handled, this results in a kernel memory leak. The fix ensures that neigh_xmit always assumes full ownership and frees the skb even when no neighbor table is found.
Affected products
- Linux Linux 4.1 to 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/0084712e0bee204b284510cdb63182fd5a30c2b7
- https://git.kernel.org/stable/c/4438113be604ee67a7bf4f81da6e1cca41332ce4
- https://git.kernel.org/stable/c/445e45a2c3a078316a62d2d331a570cf34ef5079
- https://git.kernel.org/stable/c/63063ba60d2dc334e34f1e3f9271d7f3f6f30307
- https://git.kernel.org/stable/c/8a89054a1ec0767aec25ed2bbac933da6ba3cf5a
- https://git.kernel.org/stable/c/9247d59ca15bf60a57dca08103f055d8a4340877