PT-2026-61449 · Linux · Linux

CVE-2026-64132

·

Publicado

2026-07-19

·

Atualizado

2026-07-19

CVSS v3.1

9.8

Crítica

VetorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: refresh hdr pointer before ioam6 event()
Reported by Sashiko:
In ipv6 hop ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb ensure writable(), which might reallocate the buffer:
if (skb ensure writable(skb, optoff + 2 + hdr->opt len))
	goto drop;

/* Trace pointer may have changed */
trace = (struct ioam6 trace hdr *)(skb network header(skb)
				  + optoff + sizeof(*hdr));

ioam6 fill trace data(skb, ns, trace, true);

ioam6 event(IOAM6 EVENT TRACE, dev net(skb->dev),
	  GFP ATOMIC, (void *)trace, hdr->opt len - 2);
If the skb is cloned or lacks sufficient linear headroom, skb ensure writable() will invoke pskb expand head(), which reallocates the skb's data buffer and frees the old one, invalidating pointers to it. While the code recalculates the trace pointer immediately after the call to skb ensure writable(), it fails to recalculate the hdr pointer.
This patch fixes the above by recalculating the hdr pointer before passing hdr->opt len to ioam6 event(), so that we avoid any UaF.

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64132

Produtos afetados

Linux