Executive brief
The Linux kernel's IPv6 tunneling subsystem contains a use-after-free vulnerability in packet transmission handling. When IPv6 tunnel interfaces transmit packets, they may attempt to expand buffer space and continue processing; if an error occurs after this step, the packet handler frees a previously-consumed packet buffer, leaving callers with invalid pointers. An attacker with ability to trigger tunnel transmission errors could cause kernel crashes or potentially execute code.
Technical details
The vulnerability exists in ip6_tnl_xmit() in net/ipv6/ip6_tunnel.c. The function uses skb_realloc_headroom() to expand packet buffer headroom, consumes the original socket buffer (skb), and continues processing with only a local reference to the replacement buffer. If post-reallocation error exits occur—such as tunnel encapsulation validation failures in collect_md tunnels or ip6_tnl_encap() errors—the function returns error to callers while the original skb has already been consumed. Callers (ip6_tnl_start_xmit() and IPv6 GRE paths) then attempt to free the caller-owned skb on error, resulting in a double-free/use-after-free. The fix replaces skb_realloc_headroom() with skb_cow_head(), which provides headroom without privately replacing the caller-owned buffer, preventing stale pointer issues. Patches are available in the Linux kernel stable tree.
Affected products
- Linux Linux Kernels containing vulnerable ip6_tunnel code (introduced by commit 058214a4d1df); fixed in stable branches via upstream commit 87f21b59ddc618eff9670c174842964ad65fdade
Timeline
- 2026-09-11: disclosed: CVE published
- 2026-09-07: patched: Patch merged to stable kernels by Greg Kroah-Hartman