{"id":"CVE-2026-64132","summary":"ipv6: ioam: refresh hdr pointer before ioam6_event()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: ioam: refresh hdr pointer before ioam6_event()\n\nReported by Sashiko:\n\nIn ipv6_hop_ioam(), the hdr pointer is initialized to point into the\nskb's linear data buffer. Later, the code calls skb_ensure_writable(),\nwhich might reallocate the buffer:\n\n\tif (skb_ensure_writable(skb, optoff + 2 + hdr-\u003eopt_len))\n\t\tgoto drop;\n\n\t/* Trace pointer may have changed */\n\ttrace = (struct ioam6_trace_hdr *)(skb_network_header(skb)\n\t\t\t\t\t   + optoff + sizeof(*hdr));\n\n\tioam6_fill_trace_data(skb, ns, trace, true);\n\n\tioam6_event(IOAM6_EVENT_TRACE, dev_net(skb-\u003edev),\n\t\t    GFP_ATOMIC, (void *)trace, hdr-\u003eopt_len - 2);\n\nIf the skb is cloned or lacks sufficient linear headroom,\nskb_ensure_writable() will invoke pskb_expand_head(), which reallocates\nthe skb's data buffer and frees the old one, invalidating pointers to\nit. While the code recalculates the trace pointer immediately after the\ncall to skb_ensure_writable(), it fails to recalculate the hdr pointer.\n\nThis patch fixes the above by recalculating the hdr pointer before\npassing hdr-\u003eopt_len to ioam6_event(), so that we avoid any UaF.","modified":"2026-07-22T05:29:38.342115165Z","published":"2026-07-19T15:40:27.590Z","database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64132.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/24de676da63c1122d2c13b0d546238b66d1b4e62"},{"type":"WEB","url":"https://git.kernel.org/stable/c/5af905aa8e91ff8d94572a1e089558f21dcf24ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/769723124b7c3b2bfea4cf68ad292698b87c8d01"},{"type":"WEB","url":"https://git.kernel.org/stable/c/e46e6bc97fb1f339730ff1ba74267fbf48e7a422"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64132.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64132"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"f655c78d6225f585ef60a9d93ffb79d507ff3ad3"},{"fixed":"769723124b7c3b2bfea4cf68ad292698b87c8d01"},{"fixed":"24de676da63c1122d2c13b0d546238b66d1b4e62"},{"fixed":"5af905aa8e91ff8d94572a1e089558f21dcf24ed"},{"fixed":"e46e6bc97fb1f339730ff1ba74267fbf48e7a422"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64132.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.9.0"},{"fixed":"6.12.92"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.34"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.11"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64132.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}