CVE-2026-46120
Received Received - Intake
ip6gre Use-After-Free in Linux Kernel

Publication date: 2026-05-28

Last updated on: 2026-05-28

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the device's creation netns after IFLA_NET_NS_FD migration. This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify(). Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). ip6gre_changelink() earlier in the same file already uses the cached t->net; only ip6erspan_changelink() has the wrong shape.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-28
Last Modified
2026-05-28
Generated
2026-05-28
AI Q&A
2026-05-28
EPSS Evaluated
N/A
NVD
CVE-2026-46120
EUVD
EUVD-2026-32879
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's IPv6 GRE (Generic Routing Encapsulation) implementation, specifically in the ip6erspan_changelink() function. After a certain commit, ip6erspan_newlink() was updated to correctly handle network namespaces, but ip6erspan_changelink() was not updated accordingly and still uses an outdated method to reference the network namespace.

Because of this, the tunnel is re-inserted into the wrong per-network namespace hash, leaving a stale entry in the original network namespace. When that original network namespace is destroyed, the kernel attempts to walk this stale entry, causing a use-after-free error detected by KASAN and leading to a kernel BUG in unregister_netdevice_many_notify().

This issue is reachable from an unprivileged user namespace, meaning an unprivileged user can trigger this vulnerability.


How can this vulnerability impact me? :

This vulnerability can cause a kernel use-after-free error, which may lead to a kernel crash (kernel BUG). Such crashes can result in denial of service (DoS) conditions, potentially disrupting system availability.

Since the vulnerability is reachable from an unprivileged user namespace, it could be exploited by local users to destabilize the system or cause unexpected behavior.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart