ipv6: fix use-after-free in ip6_finish_output2()
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.10.267, 5.15.218, 6.1.185, 6.12.106, 6.18.47, 6.6.154, 7.1.11, 7.2.1
- CVEs
- CVE-2026-80792
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 8 Nov 2026, 02:28 UTC · Revision 1
Source evidence
ipv6: fix use-after-free in ip6_finish_output2()
core-osv · Original sourcePublished 4 Sept 2026, 15:13 UTC
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.
osv:CVE-2026-80792
Kernel
Fixed versions: 5.10.267, 5.15.218, 6.1.185, 6.6.154, 6.12.106, 6.18.47, 7.1.11, 7.2.1
Complete source record
{
"id": "040b0b6e4dfb067c6aa71db04d1ab0e5e75cbc8e461246188d90fe34acbffd35",
"url": "https://osv.dev/vulnerability/CVE-2026-80792",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "ipv6: fix use-after-free in ip6_finish_output2()",
"summary": "In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.",
"evidence": "osv:CVE-2026-80792",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.10.267",
"evidence": "/affected/1/ranges"
},
{
"value": "5.15.218",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.185",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.154",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.106",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.47",
"evidence": "/affected/1/ranges"
},
{
"value": "7.1.11",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "CVE-2026-80792",
"aliases": [
"CVE-2026-80792"
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "4132c4ad00ddbf3a175ea0d2c775b662a32f4c85"
},
{
"fixed": "75e0a544ebe9af663ef53ca21e9e9185c51fb54a"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2"
},
{
"fixed": "c95f01b78266828a57060d754fcbfc92123a98ed"
},
{
"fixed": "d960881b9312e781a3429aabceb223ce6b7c882f"
},
{
"fixed": "087ee0d914aaae929f1660c9ca878e367655ba1a"
},
{
"fixed": "3c770ac4e6f07af7c7b40c474a3efc61ffed7862"
},
{
"fixed": "3dc98e5fe82d069dd29b124ffbdb679331dfea43"
},
{
"fixed": "99219c82804f266189388e8bf1cf5135d10d5515"
},
{
"fixed": "73a187384a8c8b983c7fea046d716b6752a1e7a3"
},
{
"fixed": "d0d48d999b0eee6bb176ef4e39d9be868fa80f7e"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.10.233"
},
{
"fixed": "5.10.267"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "5.4.289"
},
{
"fixed": "5.5"
}
]
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "1598154fd28ffa4a55beae1970475fd6776554b6"
}
]
}
],
"versions": [
"v5.10.266",
"v5.10.265",
"v5.10.264",
"v5.10.263",
"v5.10.262",
"v5.10.261",
"v5.10.260",
"v5.10.259",
"v5.10.258",
"v5.10.257",
"v5.10.256",
"v5.10.255",
"v5.10.254",
"v5.10.253",
"v5.10.252",
"v5.10.251",
"v5.10.250",
"v5.10.249",
"v5.10.248",
"v5.10.247",
"v5.10.246",
"v5.10.245",
"v5.10.244",
"v5.10.243",
"v5.10.242",
"v5.10.241",
"v5.10.240",
"v5.10.239",
"v5.10.238",
"v5.10.237",
"v5.10.236",
"v5.10.235",
"v5.10.234",
"v5.10.233",
"v5.4.302",
"v5.4.301",
"v5.4.300",
"v5.4.299",
"v5.4.298",
"v5.4.297",
"v5.4.296",
"v5.4.295",
"v5.4.294",
"v5.4.293",
"v5.4.292",
"v5.4.291",
"v5.4.290",
"v5.4.289"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80792.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "5.10.267"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.11.0"
},
{
"fixed": "5.15.218"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.15.0"
},
{
"fixed": "6.1.185"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.6.154"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.12.106"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.18.47"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "7.1.11"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.1"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80792.json"
}
}
],
"modified": "2026-10-28T02:30:52.755750118Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/087ee0d914aaae929f1660c9ca878e367655ba1a",
"https://git.kernel.org/stable/c/3c770ac4e6f07af7c7b40c474a3efc61ffed7862",
"https://git.kernel.org/stable/c/3dc98e5fe82d069dd29b124ffbdb679331dfea43",
"https://git.kernel.org/stable/c/73a187384a8c8b983c7fea046d716b6752a1e7a3",
"https://git.kernel.org/stable/c/75e0a544ebe9af663ef53ca21e9e9185c51fb54a",
"https://git.kernel.org/stable/c/99219c82804f266189388e8bf1cf5135d10d5515",
"https://git.kernel.org/stable/c/c95f01b78266828a57060d754fcbfc92123a98ed",
"https://git.kernel.org/stable/c/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e",
"https://git.kernel.org/stable/c/d960881b9312e781a3429aabceb223ce6b7c882f",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80792.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-80792",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80792.json"
}
},
"related_cves": [
{
"value": "CVE-2026-80792",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 521785,
"published_at": "2026-09-04T15:13:04.537+00:00"
}