Executive brief
A vulnerability in the Linux kernel's IPv6 networking component could lead to system instability or crashes. The issue occurs when the system processes specific network packets (Home Address Option), which can cause internal memory pointers to become invalid. This could potentially be used by an attacker to disrupt network services or cause a denial-of-service condition on affected systems.
Technical details
A vulnerability exists in the Linux kernel's IPv6 implementation within `net/ipv6/exthdrs.c`. The function `ip6_parse_tlv()` caches the network header pointer (`nh`) while iterating through IPv6 Type-Length-Value (TLV) options. When processing the Home Address Option (HAO), the helper function `ipv6_dest_hao()` may trigger `pskb_expand_head()` for cloned socket buffers (skbs). This expansion can relocate the skb head in memory, rendering the cached `nh` pointer stale. Subsequent attempts to parse trailing padding or additional TLVs using the invalidated pointer can lead to memory corruption or kernel panics. The fix involves refreshing the `nh` pointer immediately after the `ipv6_dest_hao()` call returns.
Affected products
- Linux Linux 2.6.19 to 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35
Timeline
- 2026-07-19: advisory: CVE published by NVD
- 2026-06-19: patched: Fix committed to various stable kernel branches
References
- https://git.kernel.org/stable/c/12d957979e4a800167842f1b42be6a606d227ebe
- https://git.kernel.org/stable/c/1a11eb7431e3d2882f5bd5939c5a9bbc65ccf4d1
- https://git.kernel.org/stable/c/751db1b802a067b7fff25880f4e9f9152a171538
- https://git.kernel.org/stable/c/9b6dcc0a39fd71752937f0b6b3973e1416085dcf
- https://git.kernel.org/stable/c/f7b52afe3592eae66e160586b45a3f2242972c63
- https://git.kernel.org/stable/c/f8aabed3ff3e986920cf02a2a2785e08e586b234
- https://git.kernel.org/stable/c/ff375ed1cba81392346c5bfbf0bb7a13b2946f99