Executive brief
The Linux kernel's IPv6 address configuration (addrconf) mechanism contains a race condition in its duplicate address detection (DAD) failure handler that can cause memory corruption. Under certain timing conditions, concurrent address deletion and DAD failure processing can lead to a use-after-free state, resulting in a kernel crash. This affects the stability and availability of systems relying on IPv6 networking.
Technical details
The vulnerability is a race condition in the addrconf_dad_failure() function within net/ipv6/addrconf.c. The root cause is improper synchronization between addrconf_dad_failure() and ipv6_del_addr() when transitioning address state from DAD (Duplicate Address Detection) to POSTDAD. The addrconf_dad_end() call releases the ifp->lock, allowing a concurrent ipv6_del_addr() to set the address state to DEAD and remove it from a list. When addrconf_dad_failure() re-acquires the lock and overwrites this state with ERRDAD, a subsequent scheduled dad_work calls ipv6_del_addr() again, accessing an already-poisoned list entry and triggering a general protection fault. The fix folds the addrconf_dad_end() logic into addrconf_dad_failure() under a single critical section, and adds state verification after any lock release to prevent overwriting concurrent state changes. A patch has been published and is available in the Linux kernel stable repositories.
Affected products
- Linux Linux kernel Multiple versions across linux-2.6.x through linux-7.2.y (see stable trees)
Timeline
- 2026-08-15: disclosed
- 2026-07-24: patched