CVE-2026-68127ila: reload IPv6 header after pskb_may_pull in checksum adjust
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer. Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists. Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.
- CVSS
- 9.8 CRITICAL (v3.1, CNA)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 33f11d16142b06588eedfc1dd8cf93790979a712 before e451a904606c571f731ef7a06b3398619dce5300; 33f11d16142b06588eedfc1dd8cf93790979a712 builds before 1eadcb43893b897ade85ac5bf5c618054bc3c655; from 33f11d16142b06588eedfc1dd8cf93790979a712 before ba353caafb06ccee57b78d3254e3cebf1dea4a93; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 896a9512d0d83c2a4b357e5585b7b62a8e3f95c1; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 7097a0280b178237265681be66d1bef11d15894b; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 472aba2603ca74c4f7722cb0c0296942b0776b8d; from 33f11d16142b06588eedfc1dd8cf93790979a712 before c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc; from 33f11d16142b06588eedfc1dd8cf93790979a712 before 92d3817649df2b0b6a008a686c8275c88d7ef594 | CNA record |
References
- https://git.kernel.org/stable/c/e451a904606c571f731ef7a06b3398619dce5300
- https://git.kernel.org/stable/c/1eadcb43893b897ade85ac5bf5c618054bc3c655
- https://git.kernel.org/stable/c/ba353caafb06ccee57b78d3254e3cebf1dea4a93
- https://git.kernel.org/stable/c/896a9512d0d83c2a4b357e5585b7b62a8e3f95c1
- https://git.kernel.org/stable/c/7097a0280b178237265681be66d1bef11d15894b
- https://git.kernel.org/stable/c/472aba2603ca74c4f7722cb0c0296942b0776b8d
- https://git.kernel.org/stable/c/c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc
- https://git.kernel.org/stable/c/92d3817649df2b0b6a008a686c8275c88d7ef594
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.