Executive brief
A vulnerability was identified in the Linux kernel's IPv6 networking component. It involves a race condition that can lead to a 'use-after-free' error, where the system attempts to use memory that has already been released. In practice, this could allow a local attacker to cause a system crash (denial of service) or potentially execute unauthorized code, impacting the stability and security of the affected system.
Technical details
A race condition exists in net/ipv6/anycast.c due to improper locking when inserting anycast addresses (aca) into the global hash table. Specifically, ipv6_add_acaddr_hash() was previously called outside of the idev->lock section. This allowed a concurrent device teardown (ipv6_ac_destroy_dev) to occur between the time an aca was added to the device list and when it was added to the global hash. If the teardown occurs in this window, the hash removal fails (as the item isn't there yet), but the item is subsequently inserted into the hash and then freed when its reference count drops to zero. This leaves a dangling pointer in the global hash table. A local attacker can trigger this via specific IPv6 anycast join/leave operations to cause a slab-use-after-free. The fix moves the hash insertion inside the idev->lock critical section.
Affected products
- Linux Linux Kernel eb1ac9ff6c4a5720b1a1476233be374c5dc44bff
Timeline
- 2026-05-29: disclosed: Initial patch submitted by Jiayuan Chen
- 2026-06-02: patched: Mainline kernel patch committed
- 2026-06-25: advisory: CVE-2026-53259 published