Executive brief
A vulnerability was identified in the Linux kernel's network tunneling component, which handles how data packets are wrapped and sent across different networks. Under specific conditions, the system could attempt to access memory that has already been freed or relocated during network header processing. This could lead to system instability, crashes, or potentially unauthorized access to sensitive kernel information.
Technical details
A use-after-free (UAF) vulnerability exists in the Linux kernel within the `iptunnel_pmtud_build_icmp()` and `iptunnel_pmtud_build_icmpv6()` functions in `net/ipv4/ip_tunnel_core.c`. The root cause is the caching of network header pointers (`ip_hdr()` and `ipv6_hdr()`) before a call to `skb_cow()`. Because `skb_cow()` can reallocate the socket buffer head (`skb->head`), the previously cached pointers may become invalid (dangling pointers). An attacker could potentially exploit this during Path MTU Discovery (PMTUD) for bridged IP packets to cause a kernel crash or achieve arbitrary code execution. The fix involves re-initializing these local header variables after the `skb_cow()` call to ensure they point to the correct memory location.
Affected products
- Linux Linux 5.9 to 5.10.259, 5.15.210, 6.1.176, 6.6.x, 6.9.x
Timeline
- 2026-05-25: patched: Initial patch authored by Eric Dumazet
- 2026-07-19: disclosed: CVE published to NVD dataset
References
- https://git.kernel.org/stable/c/50750d86a2e5266aba0c295483b3397843198b11
- https://git.kernel.org/stable/c/6dff77899b9e9fe5d854abda3a98ad04e7229ef7
- https://git.kernel.org/stable/c/7254aef4d1a7e18e887af9010e2f2dc34806789b
- https://git.kernel.org/stable/c/76cd9398a0470257ab765bdf5f358a2af2e17934
- https://git.kernel.org/stable/c/95b6d772bfe788331d9742d73eaa12e113b2adc4
- https://git.kernel.org/stable/c/b4bc94353050b1fa7b702bd4c6600710dd926cff
- https://git.kernel.org/stable/c/bf8b3f34c37c162357138e7c0942723b8b94fed1