Executive brief
A vulnerability was identified in the Linux kernel's handling of IPv6 network traffic. Specifically, the component responsible for receiving ICMPv6 messages (such as 'ping' or error reports) could incorrectly access memory that has already been moved or freed. While primarily a technical stability issue, such flaws can potentially lead to system crashes or unpredictable behavior when processing malformed network packets.
Technical details
A use-after-free (UAF) vulnerability exists in net/ipv6/icmp.c within the icmpv6_rcv() function. The root cause is the caching of source and destination address pointers (saddr and daddr) from the IPv6 header before calling pskb_pull(). Because pskb_pull() can trigger a reallocation of the socket buffer (skb->head), the cached pointers may become invalid (dangling), leading to a UAF when they are later accessed during debug logging (net_dbg_ratelimited). An attacker could potentially trigger this by sending specific ICMPv6 packets that force buffer reallocations. The fix involves removing the temporary variables and accessing the header directly from the current skb pointer.
Affected products
- Linux Linux 4.4 to 6.6.141
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12
- https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10f
- https://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7
- https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29a
- https://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94
- https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2
- https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8a