Executive brief
The Linux kernel's IPv6 routing subsystem contains a use-after-free vulnerability in the FIB6 (Forwarding Information Base) rule suppression logic. When a routing rule suppresses a route, the kernel fails to clear the pointer to the released route object, potentially allowing the freed memory to be reused and returned to callers. An attacker with network access could trigger this condition to cause kernel crashes or potentially execute arbitrary code.
Technical details
The vulnerability exists in the fib6_rule_suppress() function in net/ipv6/fib6_rules.c. When suppressing a route, the function calls ip6_rt_put_flags() to release a rt6_info object but fails to clear the res->rt6 pointer that references it. If no subsequent rule provides a replacement route, fib6_rule_lookup() returns the stale pointer to dst_release(), which then dereferences the freed memory via rcuref_put_slowpath(). The fix is a simple one-line change to set res->rt6 = NULL after suppressing the route. The vulnerability can be triggered by any process with network access that can craft IPv6 routing lookups that hit a suppressing rule. Network reachability is required; no authentication is needed. A patch has been merged upstream and backported to stable kernel branches.
Affected products
- Linux Linux kernel multiple versions prior to patch (commit 6aea62e433fe1b586202a5fee8b5807ce635e1d7)
Timeline
- 2026-08-21: disclosed: Published in NVD