SB2026072083 - Use-after-free in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Use-after-free (CVE-ID: CVE-2026-64132)

CWE-ID: CWE-416 - Use After Free

CVSSv4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a use-after-free in the ipv6 hop-by-hop ioam processing in ipv6_hop_ioam() when handling crafted ipv6 packets that trigger skb_ensure_writable() buffer reallocation. A local user can send a specially crafted packet to cause a denial of service.

The issue occurs because the hdr pointer is not refreshed after the skb data buffer is reallocated, while the trace pointer is recalculated.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/24de676da63c1122d2c13b0d546238b66d1b4e62
• https://git.kernel.org/stable/c/5af905aa8e91ff8d94572a1e089558f21dcf24ed
• https://git.kernel.org/stable/c/769723124b7c3b2bfea4cf68ad292698b87c8d01
• https://git.kernel.org/stable/c/e46e6bc97fb1f339730ff1ba74267fbf48e7a422