UBUNTU-CVE-2026-72429: Medium severity ubuntu/linux-hwe-edge vulnerability
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: fix type confusion of dstentry IOAM uses a dummy dstentry(nulldst) to mark that the destination should not be changed after the transformation. This dst is stored in the IOAM lwt state and may be passed to dstcachesetip6(). However, the IPv6 dst cache path eventually calls rt6getcookie(), which treats the dstentry as part of a struct rt6info. Since the nulldst was embedded directly as a struct dstentry in struct ioam6lwt, this resulted in an invalid cast and rt6getcookie() reading fields from the wrong object. In practice, the wrong cookie is not used while dst->obsolete is zero, but rt6getcookie() may also access per-cpu value when rt->sernum is zero. In this case, rt->sernum aliases ioam6lwt::cache::resetts, which can become zero, making this a potential invalid pointer access. Fix this by embedding a full struct rt6info for the dummy IPv6 route and passing its dst member to the dst APIs.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-34.34~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1012.12~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-34.34 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1007.8 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1012.12 - Upgrade
Upgrade
ubuntu/linux-raspito a version that resolves this vulnerability.Fixed in 7.0.0-1020.20 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-34.34.1 - Compensating control
Embed a full struct rt6_info for the dummy IPv6 route and pass its dst member to the dst APIs, including when the dst is stored in the IOAM lwt state and passed to dst_cache_set_ip6().
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are identified as affected?
The listed packages are ubuntu/linux-riscv, ubuntu/linux-realtime, ubuntu/linux-hwe-edge, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-azure-fde, ubuntu/linux-gke, and ubuntu/linux-aws-5.0.
What kernel functionality is involved in reaching the faulty code path?
The issue involves IPv6 IOAM lightweight tunnel state using a dummy destination entry and passing it through the IPv6 destination-cache path. That path can treat the dummy dst_entry as a struct rt6_info.
What happens when the invalid route interpretation reaches the affected condition?
If the aliased rt6_info serial number is zero, the IPv6 route-cookie lookup may access a per-CPU value using an invalid pointer. The description identifies this as a potential invalid pointer access.
What does the upstream fix change?
The fix embeds a full struct rt6_info for the dummy IPv6 route and passes that structure's dst member to destination APIs, rather than embedding only a struct dst_entry.