PT-2026-52354 · Linux · Linux Kernel
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A slab-use-after-free issue exists in the
ipv6 chk acast addr() function. The problem occurs when an anycast address (aca) is allocated and added to the idev->ac list under idev->lock, but is inserted into the global inet6 acaddr lst[] hash after the lock is released. A concurrent device teardown process can remove the aca from the ac list and attempt to delete it from the hash before the insertion has actually occurred. Consequently, the aca is later inserted into the hash and subsequently freed while still linked, leading to a dangling node that readers may dereference.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linux Kernel