CVE-2026-46120

ip6_gre: Use cached t->net in ip6erspan_changelink().

State: Published
Severity: 7.8 High
Published: May 28, 2026
Updated: Oct 19, 2026
Reserved: May 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6_gre: Use cached t->net in ip6erspan_changelink().

After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the device's creation netns after IFLA_NET_NS_FD migration.

This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify().

Reachable from an unprivileged user namespace (unshare --user --map-root-user --net).

ip6gre_changelink() earlier in the same file already uses the cached t->net; only ip6erspan_changelink() has the wrong shape.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-416 Use After Free

Affected Products

Product	Versions
LinuxLinux	2d665034f239412927b1e71329f20f001c92da09 to before 7bd0f2b162b426b343a114e1b329f0d8d14fdc6eAffected 2d665034f239412927b1e71329f20f001c92da09 to before 01b71ff2857d3598337de11e7840a8e3ff21553cAffected 2d665034f239412927b1e71329f20f001c92da09 to before 0fcf6731706f73494245a9c0d64f93bebf95bb51Affected 2d665034f239412927b1e71329f20f001c92da09 to before eca62bb0569de4d43a4dac06a2092a9d4ca1d702Affected 2d665034f239412927b1e71329f20f001c92da09 to before 311fdd26eb4443d43b909cc67a10f3a5fd1b21b2Affected 2d665034f239412927b1e71329f20f001c92da09 to before e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82Affected 2d665034f239412927b1e71329f20f001c92da09 to before cf7fc624329e76c6394653d12353e1d033adea91Affected 2d665034f239412927b1e71329f20f001c92da09 to before 1d324c2f43f70c965f25c58cc3611c779adbe47eAffected c6d72628352c949629af619b77b042e0fb5245e7Affected 4.16.12 to before 4.17Affected
LinuxLinux	4.17Affected before 4.17Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.140 through 6.6.Not affected 6.12.88 through 6.12.Not affected 6.18.30 through 6.18.Not affected 7.0.7 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

2d665034f239412927b1e71329f20f001c92da09 to before 7bd0f2b162b426b343a114e1b329f0d8d14fdc6eAffected
2d665034f239412927b1e71329f20f001c92da09 to before 01b71ff2857d3598337de11e7840a8e3ff21553cAffected
2d665034f239412927b1e71329f20f001c92da09 to before 0fcf6731706f73494245a9c0d64f93bebf95bb51Affected
2d665034f239412927b1e71329f20f001c92da09 to before eca62bb0569de4d43a4dac06a2092a9d4ca1d702Affected
2d665034f239412927b1e71329f20f001c92da09 to before 311fdd26eb4443d43b909cc67a10f3a5fd1b21b2Affected
2d665034f239412927b1e71329f20f001c92da09 to before e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82Affected
2d665034f239412927b1e71329f20f001c92da09 to before cf7fc624329e76c6394653d12353e1d033adea91Affected
2d665034f239412927b1e71329f20f001c92da09 to before 1d324c2f43f70c965f25c58cc3611c779adbe47eAffected
c6d72628352c949629af619b77b042e0fb5245e7Affected
4.16.12 to before 4.17Affected

LinuxLinux

4.17Affected
before 4.17Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.140 through 6.6.*Not affected
6.12.88 through 6.12.*Not affected
6.18.30 through 6.18.*Not affected
7.0.7 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.