CVE-2026-80792
Received Received - Intake

Use-After-Free in Linux Kernel IPv6 Networking

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80792
EUVD
EUVD-2026-71435

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a use-after-free vulnerability in the Linux kernel's IPv6 networking code. The function ip6_finish_output2() stores a pointer to the IPv6 destination address before calling lwtunnel_xmit(). If lwtunnel_xmit() reallocates the network buffer, the stored pointer becomes invalid. When the function continues execution, it uses this stale pointer to access memory that may have been freed, leading to potential data leaks, neighbor table corruption, traffic misdirection, or system crashes.

The fix involves re-fetching the IPv6 header and destination address after lwtunnel_xmit() completes to ensure all operations use valid memory.

Detection Guidance

This vulnerability is a kernel-level issue in the Linux IPv6 networking stack. Detection requires checking for kernel logs or crashes related to IPv6 packet processing. Monitor for kernel oops messages or use kernel tracing tools like ftrace or perf to detect use-after-free events in ip6_finish_output2. No specific commands are provided in the context.

Impact Analysis

This vulnerability could allow an attacker to leak sensitive kernel memory, corrupt the neighbor table with arbitrary values, redirect network traffic improperly, or cause the system to crash. It primarily affects systems using IPv6 with LWT-BPF or encapsulation features enabled.

Mitigation Strategies

Apply the kernel patch that fixes this issue by updating to a version that includes the fix for CVE-2026-80792. If patching is not immediately possible, consider disabling IPv6 or LWT-BPF features as a temporary workaround. Monitor vendor advisories for updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80792. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart