CVE-2026-46120: ip6_gre: Use cached t->net in ip6erspan_changelink().
In the Linux kernel, the following vulnerability has been resolved:
ip6gre: Use cached t->net in ip6erspanchangelink().
After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnllinkops"), ip6erspannewlink() correctly resolves the per-netns ip6gre hash via linknet. ip6erspanchangelink() was not converted in that series and still uses devnet(dev), which diverges from the device's creation netns after IFLANETNSFD migration.
This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6greexitrtnlnet() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LISTPOISON1) in unregisternetdevicemanynotify().
Reachable from an unprivileged user namespace (unshare --user --map-root-user --net).
ip6grechangelink() earlier in the same file already uses the cached t->net; only ip6erspanchangelink() has the wrong shape.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
Who can realistically trigger this issue?
The issue is reachable from an unprivileged user namespace. The described path uses unshare --user --map-root-user --net, so systems that permit unprivileged user and network namespace creation are exposed to that attack path.
What conditions are needed to trigger the use-after-free?
An IP6 ERSPAN tunnel must be migrated using IFLA_NET_NS_FD and then changed through ip6erspan_changelink(). The original network namespace must later be destroyed, causing cleanup to walk the stale tunnel entry.
How can I recognize that this issue may already have occurred?
The reported failure pattern is a KASAN slab-use-after-free during network-namespace teardown, followed by a kernel BUG at net/core/dev.c involving LIST_POISON1 in unregister_netdevice_many_notify().