ipv6: fix possible UAF in icmpv6_rcv()

Summary

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: • We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. • Avoid potential future misuse after pskb_pull() call.

Timeline

1. Jun 24, 2026, 4:29 PM UTCCVE published
2. Oct 16, 2026, 3:24 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: yes · Technical impact: total

3. Oct 19, 2026, 7:47 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in 7bff2c8fe5c35ae58bf73104f53db3676e6e5d94; From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in aff0f28f5be803de2452ce702631c021fcd9ce8a; From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in 38bdbc897c0d83a3e2b925a51b69420f1feba29a; From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in 0069813e6ca9309eca78022bcb3aeb1e9ef90a12; From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in 1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7; From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in 7c66b368c6ff453f99cb39d84af93e908e51eef2; From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in 085e31a811ef234ef8c3e219c4636dfebfe7e10f; From 4b3418fba0fe819197e3359d5ddbef84ba2c59de · fixed in f996edd7615e686ada141b7f3395025729ff8ccb

• Linux Linux

  4.4

• KernelLinux

  From 4.4.0 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.141; From 6.7.0 · fixed in 6.12.91; From 6.13.0 · fixed in 6.18.33; From 6.19.0 · fixed in 7.0.10

References 8