CVE-2026-80792

ipv6: fix use-after-free in ip6_finish_output2()

State: Published
Severity: Not scored
Published: Sep 4, 2026
Updated: Oct 19, 2026
Reserved: Aug 26, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix use-after-free in ip6_finish_output2()

ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system.

Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	4132c4ad00ddbf3a175ea0d2c775b662a32f4c85 to before 75e0a544ebe9af663ef53ca21e9e9185c51fb54aAffected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before c95f01b78266828a57060d754fcbfc92123a98edAffected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before d960881b9312e781a3429aabceb223ce6b7c882fAffected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 087ee0d914aaae929f1660c9ca878e367655ba1aAffected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 3c770ac4e6f07af7c7b40c474a3efc61ffed7862Affected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 3dc98e5fe82d069dd29b124ffbdb679331dfea43Affected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 99219c82804f266189388e8bf1cf5135d10d5515Affected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 73a187384a8c8b983c7fea046d716b6752a1e7a3Affected e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before d0d48d999b0eee6bb176ef4e39d9be868fa80f7eAffected 1598154fd28ffa4a55beae1970475fd6776554b6Affected 5.10.233 to before 5.10.267Affected 5.4.289 to before 5.5Affected
LinuxLinux	5.15Affected before 5.15Not affected 5.10.267 through 5.10.Not affected 5.15.218 through 5.15.Not affected 6.1.185 through 6.1.Not affected 6.6.154 through 6.6.Not affected 6.12.106 through 6.12.Not affected 6.18.47 through 6.18.Not affected 7.1.11 through 7.1.Not affected 7.2.1 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

4132c4ad00ddbf3a175ea0d2c775b662a32f4c85 to before 75e0a544ebe9af663ef53ca21e9e9185c51fb54aAffected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before c95f01b78266828a57060d754fcbfc92123a98edAffected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before d960881b9312e781a3429aabceb223ce6b7c882fAffected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 087ee0d914aaae929f1660c9ca878e367655ba1aAffected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 3c770ac4e6f07af7c7b40c474a3efc61ffed7862Affected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 3dc98e5fe82d069dd29b124ffbdb679331dfea43Affected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 99219c82804f266189388e8bf1cf5135d10d5515Affected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before 73a187384a8c8b983c7fea046d716b6752a1e7a3Affected
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 to before d0d48d999b0eee6bb176ef4e39d9be868fa80f7eAffected
1598154fd28ffa4a55beae1970475fd6776554b6Affected
5.10.233 to before 5.10.267Affected
5.4.289 to before 5.5Affected

LinuxLinux

5.15Affected
before 5.15Not affected
5.10.267 through 5.10.*Not affected
5.15.218 through 5.15.*Not affected
6.1.185 through 6.1.*Not affected
6.6.154 through 6.6.*Not affected
6.12.106 through 6.12.*Not affected
6.18.47 through 6.18.*Not affected
7.1.11 through 7.1.*Not affected
7.2.1 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.