SB20260924125 - Improper control of a resource through its lifetime in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2026-97472)

CWE-ID: CWE-664 - Improper control of a resource through its lifetime

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to prevent generation of temporary IPv6 privacy addresses for an IPv6 prefix.

The vulnerability exists due to improper state management in the IPv6 addrconf temporary address management logic when handling router advertisements that deprecate and later restore an IPv6 prefix. A remote attacker can send router advertisements that temporarily deprecate and later restore a prefix to prevent temporary address regeneration.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/4df5597c65446135362f72880995e8920f058fa0
• https://git.kernel.org/stable/c/bff7b87dfa28a1502c18d0c6f1fadda5162fa854
• https://git.kernel.org/stable/c/e20d8922aa8fe441d291364c96c2179a005b79ea