Bug 2528542 (CVE-2026-80792) - CVE-2026-80792 kernel: ipv6: fix use-after-free in ip6_finish_output2()
Summary: CVE-2026-80792 kernel: ipv6: fix use-after-free in ip6_finish_output2()
Keywords:
Status: NEW
Alias: CVE-2026-80792
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-04 15:32 UTC by OSIDB Bzimport
Modified: 2026-11-12 02:52 UTC (History)
18 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:76738 0 None None None 2026-10-07 20:28:56 UTC
Red Hat Product Errata RHSA-2026:76739 0 None None None 2026-10-08 09:50:27 UTC
Red Hat Product Errata RHSA-2026:77218 0 None None None 2026-10-07 06:27:45 UTC
Red Hat Product Errata RHSA-2026:77219 0 None None None 2026-10-08 07:23:07 UTC
Red Hat Product Errata RHSA-2026:83707 0 None None None 2026-10-16 13:30:12 UTC
Red Hat Product Errata RHSA-2026:89197 0 None None None 2026-10-27 22:03:18 UTC
Red Hat Product Errata RHSA-2026:89232 0 None None None 2026-10-27 11:59:05 UTC
Red Hat Product Errata RHSA-2026:89333 0 None None None 2026-10-27 12:00:08 UTC
Red Hat Product Errata RHSA-2026:89651 0 None None None 2026-10-27 12:21:20 UTC
Red Hat Product Errata RHSA-2026:89714 0 None None None 2026-10-27 17:58:46 UTC
Red Hat Product Errata RHSA-2026:89725 0 None None None 2026-10-27 14:10:01 UTC
Red Hat Product Errata RHSA-2026:92993 0 None None None 2026-10-30 06:30:42 UTC
Red Hat Product Errata RHSA-2026:93047 0 None None None 2026-10-30 13:05:55 UTC
Red Hat Product Errata RHSA-2026:95508 0 None None None 2026-11-09 17:07:08 UTC
Red Hat Product Errata RHSA-2026:95745 0 None None None 2026-11-11 01:43:46 UTC
Red Hat Product Errata RHSA-2026:96282 0 None None None 2026-11-11 01:46:49 UTC
Red Hat Product Errata RHSA-2026:99135 0 None None None 2026-11-12 02:52:30 UTC

Description OSIDB Bzimport 2026-09-04 15:32:07 UTC 
In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix use-after-free in ip6_finish_output2()

ip6_finish_output2() caches a pointer to the IPv6 destination
address (daddr) before invoking lwtunnel_xmit().  The LWT-BPF
transmit path or other encapsulation operations within
lwtunnel_xmit() can reallocate the skb head, freeing the memory
that daddr points to.  When lwtunnel_xmit() returns
LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale
daddr pointer to compute the nexthop and to look up or create the
neighbour entry.  This results in a use-after-free read, which can
leak sensitive kernel data, pollute the neighbour table with
arbitrary values, misdirect traffic, or crash the system.

Fix this by re-fetching the IPv6 header and the destination
address pointer after lwtunnel_xmit() returns
LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop
computation and neighbour lookup operate on valid memory.
Comment 1 Mauro Matteo Cascella 2026-09-04 18:33:28 UTC 
Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-80792.mbox
Comment 6 Jon Orris 2026-10-07 06:27:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:77218 https://access.redhat.com/errata/RHSA-2026:77218
Comment 7 Jon Orris 2026-10-07 20:28:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:76738 https://access.redhat.com/errata/RHSA-2026:76738
Comment 8 Jon Orris 2026-10-08 07:23:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:77219 https://access.redhat.com/errata/RHSA-2026:77219
Comment 9 Jon Orris 2026-10-08 09:50:25 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:76739 https://access.redhat.com/errata/RHSA-2026:76739
Comment 10 Jon Orris 2026-10-16 13:30:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:83707 https://access.redhat.com/errata/RHSA-2026:83707
Comment 12 Jon Orris 2026-10-27 11:59:03 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.21

Via RHSA-2026:89232 https://access.redhat.com/errata/RHSA-2026:89232
Comment 13 Jon Orris 2026-10-27 12:00:06 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.20

Via RHSA-2026:89333 https://access.redhat.com/errata/RHSA-2026:89333
Comment 14 Jon Orris 2026-10-27 12:21:18 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.19

Via RHSA-2026:89651 https://access.redhat.com/errata/RHSA-2026:89651
Comment 15 Jon Orris 2026-10-27 14:09:59 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.18

Via RHSA-2026:89725 https://access.redhat.com/errata/RHSA-2026:89725
Comment 16 Jon Orris 2026-10-27 17:58:45 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.16

Via RHSA-2026:89714 https://access.redhat.com/errata/RHSA-2026:89714
Comment 17 Jon Orris 2026-10-27 22:03:16 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.22

Via RHSA-2026:89197 https://access.redhat.com/errata/RHSA-2026:89197
Comment 18 Jon Orris 2026-10-30 06:30:40 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:92993 https://access.redhat.com/errata/RHSA-2026:92993
Comment 19 Jon Orris 2026-10-30 13:05:53 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:93047 https://access.redhat.com/errata/RHSA-2026:93047
Comment 20 errata-xmlrpc 2026-11-09 17:07:02 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.14

Via RHSA-2026:95508 https://access.redhat.com/errata/RHSA-2026:95508
Comment 21 errata-xmlrpc 2026-11-11 01:43:44 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.13

Via RHSA-2026:95745 https://access.redhat.com/errata/RHSA-2026:95745
Comment 22 errata-xmlrpc 2026-11-11 01:46:48 UTC 
This issue has been addressed in the following products:

  Red Hat OpenShift Container Platform 4.17

Via RHSA-2026:96282 https://access.redhat.com/errata/RHSA-2026:96282
Comment 23 errata-xmlrpc 2026-11-12 02:52:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:99135 https://access.redhat.com/errata/RHSA-2026:99135
Note You need to log in before you can comment on or make changes to this bug.