Executive brief
A vulnerability was identified in the Linux kernel's IPv6 implementation, specifically within the In-situ Operations, Administration, and Maintenance (IOAM) component. This component is used for network telemetry and monitoring. An exploit could lead to a system crash or memory corruption, potentially impacting the stability and availability of servers or networking equipment running affected versions of Linux.
Technical details
A use-after-free (UaF) vulnerability exists in net/ipv6/exthdrs.c within the ipv6_hop_ioam() function. The vulnerability occurs because the 'hdr' pointer, which points into the skb's linear data buffer, is not recalculated after a call to skb_ensure_writable(). If skb_ensure_writable() triggers pskb_expand_head() to reallocate the buffer, the original 'hdr' pointer becomes dangling. Subsequent access to hdr->opt_len during the ioam6_event() call results in a use-after-free. The fix involves refreshing the 'hdr' pointer immediately after the buffer is ensured to be writable.
Affected products
- Linux Linux Kernel 6.9 to 7.1
Timeline
- 2026-05-20: other: Patch submitted by Justin Iurman
- 2026-07-19: disclosed: CVE-2026-64132 published