CVE-2026-90111

ip6mr: do not clone dst in ip6mr_cache_report()

State: Published
Severity: 7.8 High
Published: Sep 17, 2026
Updated: Oct 30, 2026
Reserved: Sep 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ip6mr: do not clone dst in ip6mr_cache_report()

IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU. When an ingress multicast packet misses MFC lookup, ip6mr_cache_unresolved() places the skb onto the unresolved queue, escaping the receive-side RCU grace period.

If the underlying route is deleted and freed, and the MFC queue is later resolved with a wrong parent interface, ip6_mr_forward() invokes ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab use-after-free.

Report packets queued to mroute6_sk (a raw socket) and netlink notifications do not require an attached dst entry.

Fix this by: 1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs do not hold a dst. 2. Dropping skb_dst before queuing unresolved skbs in ip6mr_cache_unresolved(), matching the fact that multicast forwarding resolves outgoing routes anew via ip6_route_output().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	67f415dd29063a5906c560051c00e42dcf01a4dd to before b50d3cfb8513e895cee453dd0f834deee6ccc231Affected 67f415dd29063a5906c560051c00e42dcf01a4dd to before 7f8287f606c8c028d4224e85d95dc448c6d6d623Affected 67f415dd29063a5906c560051c00e42dcf01a4dd to before 42ef371466d5648f5c9e8bc219f0af0a2c2bbf8cAffected 67f415dd29063a5906c560051c00e42dcf01a4dd to before f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89Affected 67f415dd29063a5906c560051c00e42dcf01a4dd to before 4a674afaae4136c71943aa3e35d433676fd40e8fAffected 67f415dd29063a5906c560051c00e42dcf01a4dd to before 235b42b5860189eb8c27c36435ad932cae65a734Affected
LinuxLinux	5.3Affected before 5.3Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.57 through 6.18.Not affected 7.2.6 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

67f415dd29063a5906c560051c00e42dcf01a4dd to before b50d3cfb8513e895cee453dd0f834deee6ccc231Affected
67f415dd29063a5906c560051c00e42dcf01a4dd to before 7f8287f606c8c028d4224e85d95dc448c6d6d623Affected
67f415dd29063a5906c560051c00e42dcf01a4dd to before 42ef371466d5648f5c9e8bc219f0af0a2c2bbf8cAffected
67f415dd29063a5906c560051c00e42dcf01a4dd to before f57b0fd1c62e1be274ee154ab7fb8ac4481b7f89Affected
67f415dd29063a5906c560051c00e42dcf01a4dd to before 4a674afaae4136c71943aa3e35d433676fd40e8fAffected
67f415dd29063a5906c560051c00e42dcf01a4dd to before 235b42b5860189eb8c27c36435ad932cae65a734Affected

LinuxLinux

5.3Affected
before 5.3Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.57 through 6.18.*Not affected
7.2.6 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.