CVE-2026-53006

ipv6: fix possible UAF in icmpv6_rcv()

State: Published
Severity: 9.8 Critical
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix possible UAF in icmpv6_rcv()

Caching saddr and daddr before pskb_pull() is problematic since skb->head can change.

Remove these temporary variables:

- We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path.

- Avoid potential future misuse after pskb_pull() call.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-825 Expired Pointer Dereference

Affected Products

Product	Versions
LinuxLinux	4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 7bff2c8fe5c35ae58bf73104f53db3676e6e5d94Affected 4b3418fba0fe819197e3359d5ddbef84ba2c59de to before aff0f28f5be803de2452ce702631c021fcd9ce8aAffected 4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 38bdbc897c0d83a3e2b925a51b69420f1feba29aAffected 4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 0069813e6ca9309eca78022bcb3aeb1e9ef90a12Affected 4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7Affected 4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 7c66b368c6ff453f99cb39d84af93e908e51eef2Affected 4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 085e31a811ef234ef8c3e219c4636dfebfe7e10fAffected 4b3418fba0fe819197e3359d5ddbef84ba2c59de to before f996edd7615e686ada141b7f3395025729ff8ccbAffected
LinuxLinux	4.4Affected before 4.4Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 7bff2c8fe5c35ae58bf73104f53db3676e6e5d94Affected
4b3418fba0fe819197e3359d5ddbef84ba2c59de to before aff0f28f5be803de2452ce702631c021fcd9ce8aAffected
4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 38bdbc897c0d83a3e2b925a51b69420f1feba29aAffected
4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 0069813e6ca9309eca78022bcb3aeb1e9ef90a12Affected
4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7Affected
4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 7c66b368c6ff453f99cb39d84af93e908e51eef2Affected
4b3418fba0fe819197e3359d5ddbef84ba2c59de to before 085e31a811ef234ef8c3e219c4636dfebfe7e10fAffected
4b3418fba0fe819197e3359d5ddbef84ba2c59de to before f996edd7615e686ada141b7f3395025729ff8ccbAffected

LinuxLinux

4.4Affected
before 4.4Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.