Executive brief
A vulnerability in the Linux kernel's networking component could allow an attacker to cause a system crash. The issue occurs when the system is cleaning up network resources, specifically during the handling of fragmented internet traffic. This could lead to a denial-of-service condition, impacting the availability of affected servers or devices.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel's inet fragment reassembly logic. During network namespace (netns) teardown, the fqdir_pre_exit() function flushes fragment queues using inet_frag_queue_flush(). While this helper frees the associated socket buffers (skbs), it fails to reset internal pointers (fragments_tail and last_run_head) or set the INET_FRAG_COMPLETE flag. A race condition occurs if a fragment processing thread already obtained a reference to the queue before the flush; upon resuming, it may dereference the now-freed skb pointers. This affects IPv4, IPv6, nf_conntrack_reasm6, and 6lowpan reassembly. The fix involves explicitly resetting these pointers during the flush operation.
Affected products
- Linux Linux Kernel 6.12.93 to 6.12.94, 6.18.3 and later
Timeline
- 2026-06-02: other: Vulnerability fixed in upstream commits
- 2026-06-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/010c3313a4d178dc2d3ce958d2e5cb055e2864c1
- https://git.kernel.org/stable/c/0e823ca0e7391630784ae7dd0981b7ad170a93d9
- https://git.kernel.org/stable/c/32594b09854970d7ba83eb2dc8c69a2edd158c8e
- https://git.kernel.org/stable/c/89b909e9704587bfecc1aab1d37e98faee03b9f9
- https://git.kernel.org/stable/c/c22599cc90e1cd5f8129c8670bd68a02ff7177b4