Executive brief
The Linux kernel's netfilter flowtable module, which accelerates network packet processing for IPv6-in-IPv6 tunnels, contains a buffer handling error in the IPv6 tunnel detection logic. An attacker can craft malformed IPv6 tunnel packets to trigger memory access violations or packet processing failures, potentially causing network service disruption or enabling further exploitation on systems using IPv6 tunneling.
Technical details
The vulnerability exists in nf_flow_ip6_tunnel_proto() in net/netfilter/nf_flow_table_ip.c. The function incorrectly uses skb_header_pointer() instead of pskb_may_pull() when accessing the outer IPv6 header, which can leave the header data outside the socket buffer's linear headroom, causing subsequent packet processing to fail or access invalid memory. Additionally, ctx->offset was updated unconditionally rather than only when an actual IP6IP6 tunnel was detected, and the code unnecessarily processed extension headers that the fast path cannot handle. The fix ensures proper buffer bounds checking, moves offset updates into the conditional block for actual tunnels, and removes unsupported extension header processing. Attack vector is network-based; no authentication required. An attacker on the network path can send crafted IPv6 tunnel packets to trigger the flaw.
Affected products
- Linux Linux kernel Affected versions with netfilter flowtable IP6IP6 acceleration; patched in stable trees as of 2026-07-24
Timeline
- 2026-06-15: other: Original commit by Lorenzo Bianconi
- 2026-06-19: patched: Patch merged upstream
- 2026-07-24: patched: Backported to stable kernel trees
- 2026-08-15: disclosed: Published on NVD