CVE-2026-46172: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: xfrm6: release dst on error in xfrm6rcvencap()
xfrm6rcvencap() performs an IPv6 route lookup when the skb does not already have a dst attached. ip6routeinputlookup() returns a referenced dst entry even when the lookup resolves to an error route.
If dst->error is set, xfrm6rcvencap() drops the skb without attaching the dst to the skb and without releasing the reference returned by the lookup. Repeated packets hitting this path therefore leak dst entries.
Release the dst before jumping to the drop path.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-46172?
The severity of CVE-2026-46172 is rated at 20.
How do I fix CVE-2026-46172?
To fix CVE-2026-46172, update your Linux kernel to the latest version that addresses this vulnerability.
What type of vulnerability is CVE-2026-46172?
CVE-2026-46172 is a vulnerability in the Linux kernel related to IPv6 route handling.
What impact does CVE-2026-46172 have on Linux systems?
CVE-2026-46172 can lead to a stability issue due to improper handling of destination entries during IPv6 route lookups.
When was CVE-2026-46172 published?
CVE-2026-46172 was published on May 28, 2026.