PT-2026-44243 · Linux · Linux Kernel

Published 2026-05-28 · Updated 2026-05-28 · CVE-2026-46120

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free occurs in the ip6erspan changelink() function. The issue arises because the function uses dev net(dev) instead of the cached t->net, which causes the tunnel to be inserted into the incorrect per-netns hash after an IFLA NET NS FD migration. This results in a stale entry remaining in the original network namespace. When that namespace is destroyed, ip6gre exit rtnl net() processes the stale entry, leading to a kernel BUG in unregister netdevice many notify(). This can be reached by an unprivileged user namespace.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-46120

Affected Products

Linux Kernel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-46120 · Security Note
• https://git.kernel.org/stable/c/eca62bb0569de4d43a4dac06a2092a9d4ca1d702 · Note
• https://git.kernel.org/stable/c/e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82 · Note
• https://git.kernel.org/stable/c/1d324c2f43f70c965f25c58cc3611c779adbe47e · Note
• https://git.kernel.org/stable/c/311fdd26eb4443d43b909cc67a10f3a5fd1b21b2 · Note
• https://twitter.com/vuldb/status/2059954629111402712 · Twitter Post
• https://git.kernel.org/stable/c/cf7fc624329e76c6394653d12353e1d033adea91 · Note