Executive brief
The Linux kernel's IPv6 packet output handler can reference freed memory after certain encapsulation operations, potentially leaking sensitive kernel data, corrupting network routing tables, or crashing systems. This affects any Linux server or network appliance that processes IPv6 traffic with certain tunnel or BPF encapsulation configurations enabled.
Technical details
The vulnerability is a use-after-free condition in the ip6_finish_output2() function in net/ipv6/ip6_output.c. The function caches a pointer to the IPv6 destination address (daddr) from the packet header before calling lwtunnel_xmit(). If lwtunnel_xmit() triggers certain encapsulation or LWT-BPF transmit paths, it can reallocate the socket buffer (skb) head memory, invalidating the cached daddr pointer. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues using the stale daddr pointer to compute the nexthop and look up the neighbour entry, reading from freed memory. The fix re-fetches the IPv6 header and daddr pointer after lwtunnel_xmit() returns. A local or remote attacker with the ability to inject or trigger encapsulated IPv6 packets can exploit this to leak kernel memory or crash the system. The vulnerability affects Linux kernel versions from 5.16 onwards (where skb_expand_head was introduced in ip6_finish_output2) through at least 6.12.
Affected products
- Linux Linux Kernel 5.16 through 6.12 and later affected versions
Timeline
- 2026-09-04: disclosed: CVE-2026-80792 published
- 2026-08-27: patched: Stable kernel fixes released
- 2026-08-12: other: Patch submitted by Luxiao Xu