{"id":"CVE-2026-80792","summary":"ipv6: fix use-after-free in ip6_finish_output2()","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: fix use-after-free in ip6_finish_output2()\n\nip6_finish_output2() caches a pointer to the IPv6 destination\naddress (daddr) before invoking lwtunnel_xmit().  The LWT-BPF\ntransmit path or other encapsulation operations within\nlwtunnel_xmit() can reallocate the skb head, freeing the memory\nthat daddr points to.  When lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, the function continues to use the stale\ndaddr pointer to compute the nexthop and to look up or create the\nneighbour entry.  This results in a use-after-free read, which can\nleak sensitive kernel data, pollute the neighbour table with\narbitrary values, misdirect traffic, or crash the system.\n\nFix this by re-fetching the IPv6 header and the destination\naddress pointer after lwtunnel_xmit() returns\nLWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop\ncomputation and neighbour lookup operate on valid memory.","modified":"2026-11-08T02:30:31.727889668Z","published":"2026-09-04T15:13:04.537Z","related":["ALSA-2026:76738","openSUSE-SU-2026:11773-1"],"database_specific":{"cna_assigner":"Linux","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80792.json"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/087ee0d914aaae929f1660c9ca878e367655ba1a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3c770ac4e6f07af7c7b40c474a3efc61ffed7862"},{"type":"WEB","url":"https://git.kernel.org/stable/c/3dc98e5fe82d069dd29b124ffbdb679331dfea43"},{"type":"WEB","url":"https://git.kernel.org/stable/c/73a187384a8c8b983c7fea046d716b6752a1e7a3"},{"type":"WEB","url":"https://git.kernel.org/stable/c/75e0a544ebe9af663ef53ca21e9e9185c51fb54a"},{"type":"WEB","url":"https://git.kernel.org/stable/c/99219c82804f266189388e8bf1cf5135d10d5515"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c95f01b78266828a57060d754fcbfc92123a98ed"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d960881b9312e781a3429aabceb223ce6b7c882f"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80792.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-80792"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"4132c4ad00ddbf3a175ea0d2c775b662a32f4c85"},{"fixed":"75e0a544ebe9af663ef53ca21e9e9185c51fb54a"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2"},{"fixed":"c95f01b78266828a57060d754fcbfc92123a98ed"},{"fixed":"d960881b9312e781a3429aabceb223ce6b7c882f"},{"fixed":"087ee0d914aaae929f1660c9ca878e367655ba1a"},{"fixed":"3c770ac4e6f07af7c7b40c474a3efc61ffed7862"},{"fixed":"3dc98e5fe82d069dd29b124ffbdb679331dfea43"},{"fixed":"99219c82804f266189388e8bf1cf5135d10d5515"},{"fixed":"73a187384a8c8b983c7fea046d716b6752a1e7a3"},{"fixed":"d0d48d999b0eee6bb176ef4e39d9be868fa80f7e"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.10.233"},{"fixed":"5.10.267"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"5.4.289"},{"fixed":"5.5"}]},{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"1598154fd28ffa4a55beae1970475fd6776554b6"}]}],"versions":["v5.10.266","v5.10.265","v5.10.264","v5.10.263","v5.10.262","v5.10.261","v5.10.260","v5.10.259","v5.10.258","v5.10.257","v5.10.256","v5.10.255","v5.10.254","v5.10.253","v5.10.252","v5.10.251","v5.10.250","v5.10.249","v5.10.248","v5.10.247","v5.10.246","v5.10.245","v5.10.244","v5.10.243","v5.10.242","v5.10.241","v5.10.240","v5.10.239","v5.10.238","v5.10.237","v5.10.236","v5.10.235","v5.10.234","v5.10.233","v5.4.302","v5.4.301","v5.4.300","v5.4.299","v5.4.298","v5.4.297","v5.4.296","v5.4.295","v5.4.294","v5.4.293","v5.4.292","v5.4.291","v5.4.290","v5.4.289"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80792.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.10.267"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.218"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.15.0"},{"fixed":"6.1.185"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.6.154"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.12.106"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.18.47"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"7.1.11"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.2.1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80792.json"}}],"schema_version":"1.9.2"}