Skip to content
Heist/ feed
Critical

ila: reload IPv6 header after pskb_may_pull in checksum adjust

Type: advisorySource: Official CVE List1 source record

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer. Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists. Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.

Announced Source revision 1
Original source ↗

CVE-2026-68127

Primary source · Revision 1

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: cve:CVE-2026-68127

Linux

Source reference: /containers/cna/affected/0/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Linux

Source reference: /containers/cna/affected/1/product

Affected versions
Not stated in this record
Fixed versions
Not stated in this record
Prerequisites
Not stated in this record

Structured affected-version data

Original package identities and version rules from this source.

[
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "e451a904606c571f731ef7a06b3398619dce5300",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "1eadcb43893b897ade85ac5bf5c618054bc3c655",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "ba353caafb06ccee57b78d3254e3cebf1dea4a93",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "896a9512d0d83c2a4b357e5585b7b62a8e3f95c1",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "7097a0280b178237265681be66d1bef11d15894b",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "472aba2603ca74c4f7722cb0c0296942b0776b8d",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc",
        "versionType": "git"
      },
      {
        "status": "affected",
        "version": "33f11d16142b06588eedfc1dd8cf93790979a712",
        "lessThan": "92d3817649df2b0b6a008a686c8275c88d7ef594",
        "versionType": "git"
      }
    ],
    "programFiles": [
      "net/ipv6/ila/ila_common.c"
    ],
    "defaultStatus": "unaffected"
  },
  {
    "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
    "vendor": "Linux",
    "product": "Linux",
    "versions": [
      {
        "status": "affected",
        "version": "4.5"
      },
      {
        "status": "unaffected",
        "version": "0",
        "lessThan": "4.5",
        "versionType": "semver"
      },
      {
        "status": "unaffected",
        "version": "5.10.265",
        "versionType": "semver",
        "lessThanOrEqual": "5.10.*"
      },
      {
        "status": "unaffected",
        "version": "5.15.216",
        "versionType": "semver",
        "lessThanOrEqual": "5.15.*"
      },
      {
        "status": "unaffected",
        "version": "6.1.183",
        "versionType": "semver",
        "lessThanOrEqual": "6.1.*"
      },
      {
        "status": "unaffected",
        "version": "6.6.148",
        "versionType": "semver",
        "lessThanOrEqual": "6.6.*"
      },
      {
        "status": "unaffected",
        "version": "6.12.101",
        "versionType": "semver",
        "lessThanOrEqual": "6.12.*"
      },
      {
        "status": "unaffected",
        "version": "6.18.42",
        "versionType": "semver",
        "lessThanOrEqual": "6.18.*"
      },
      {
        "status": "unaffected",
        "version": "7.1.6",
        "versionType": "semver",
        "lessThanOrEqual": "7.1.*"
      },
      {
        "status": "unaffected",
        "version": "7.2",
        "versionType": "original_commit_for_fix",
        "lessThanOrEqual": "*"
      }
    ],
    "programFiles": [
      "net/ipv6/ila/ila_common.c"
    ],
    "defaultStatus": "affected"
  }
]
Related CVEs
CVE-2026-68127

Source reference: /cveMetadata/cveId

Publisher severity

critical

Source reference: /containers/cna/metrics

Event
#41128 · Revision 1
Added to Heist Feed
Publisher date
Read the original announcement