PT-2026-61449 · Linux · Linux

CVE-2026-64132

·

Published

2026-07-19

·

Updated

2026-07-19

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
In the Linux kernel, the following vulnerability has been resolved:
ipv6: ioam: refresh hdr pointer before ioam6 event()
Reported by Sashiko:
In ipv6 hop ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb ensure writable(), which might reallocate the buffer:
if (skb ensure writable(skb, optoff + 2 + hdr->opt len))
	goto drop;

/* Trace pointer may have changed */
trace = (struct ioam6 trace hdr *)(skb network header(skb)
				  + optoff + sizeof(*hdr));

ioam6 fill trace data(skb, ns, trace, true);

ioam6 event(IOAM6 EVENT TRACE, dev net(skb->dev),
	  GFP ATOMIC, (void *)trace, hdr->opt len - 2);
If the skb is cloned or lacks sufficient linear headroom, skb ensure writable() will invoke pskb expand head(), which reallocates the skb's data buffer and frees the old one, invalidating pointers to it. While the code recalculates the trace pointer immediately after the call to skb ensure writable(), it fails to recalculate the hdr pointer.
This patch fixes the above by recalculating the hdr pointer before passing hdr->opt len to ioam6 event(), so that we avoid any UaF.

Fix

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Related Identifiers

CVE-2026-64132

Affected Products

Linux