CVE-2026-46120

Analyzed Analyzed - Analysis Complete

ip6gre Use-After-Free in Linux Kernel

Publication date: 2026-05-28

Last updated on: 2026-06-24

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the device's creation netns after IFLA_NET_NS_FD migration. This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify(). Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). ip6gre_changelink() earlier in the same file already uses the cached t->net; only ip6erspan_changelink() has the wrong shape.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-05-28

Last Modified

2026-06-24

Generated

2026-07-08

AI Q&A

2026-05-28

EPSS Evaluated

2026-07-06

NVD

CVE-2026-46120

EUVD

EUVD-2026-32879

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	4.17
linux	linux_kernel	4.17
linux	linux_kernel	From 4.16.12 (inc) to 4.17 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.13 (inc) to 6.18.30 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.7 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.88 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.140 (exc)
linux	linux_kernel	From 4.17.1 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's IPv6 GRE (Generic Routing Encapsulation) implementation, specifically in the ip6erspan_changelink() function. After a certain commit, ip6erspan_newlink() was updated to correctly handle network namespaces, but ip6erspan_changelink() was not updated accordingly and still uses an outdated method to reference the network namespace.

Because of this, the tunnel is re-inserted into the wrong per-network namespace hash, leaving a stale entry in the original network namespace. When that original network namespace is destroyed, the kernel attempts to walk this stale entry, causing a use-after-free error detected by KASAN and leading to a kernel BUG in unregister_netdevice_many_notify().

This issue is reachable from an unprivileged user namespace, meaning an unprivileged user can trigger this vulnerability.

Impact Analysis

This vulnerability can cause a kernel use-after-free error, which may lead to a kernel crash (kernel BUG). Such crashes can result in denial of service (DoS) conditions, potentially disrupting system availability.

Since the vulnerability is reachable from an unprivileged user namespace, it could be exploited by local users to destabilize the system or cause unexpected behavior.

Hi! I’m here to help you understand CVE-2026-46120. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70