CVE-2026-80792: ipv6: fix use-after-free in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix use-after-free in ip6finishoutput2()
ip6finishoutput2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnelxmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnelxmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnelxmit() returns LWTUNNELXMITCONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system.
Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnelxmit() returns LWTUNNELXMITCONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems are exposed when IPv6 traffic passes through an lwtunnel transmit path, such as LWT-BPF or another encapsulation operation, that can reallocate the skb head and then returns LWTUNNEL_XMIT_CONTINUE. The stale pointer is used afterward for nexthop computation and neighbour lookup.
What can happen if the vulnerable path is triggered?
The use-after-free read can leak sensitive kernel data, insert arbitrary values into the neighbour table, misdirect traffic, or crash the system.
What is the remediation?
Use a Linux kernel update containing the fix that re-fetches the IPv6 header and destination address after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE. This ensures subsequent routing and neighbour operations use valid memory.