1. Home
  2. Vulnerabilities
  3. CVE-2026-68127
9.8
CRITICAL CVSS 3.1
CVE-2026-68127
ila: reload IPv6 header after pskb_may_pull in checksum adjust
Overview
Description

In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer. Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists. Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.

Details
INFO

Published Date :

Aug. 10, 2026, 1:19 p.m.

Last Modified :

Aug. 17, 2026, 5:18 a.m.

Remotely Exploit :

Yes !

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Impact
Affected Products

The following products are affected by CVE-2026-68127 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
: Total Affected Vendor : 1 | Products : 1
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 CRITICAL 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Fix Linux kernel vulnerability by reloading IPv6 header after pskb_may_pull.
  • Reload ip6h after pskb_may_pull in ila_csum_adjust_transport.
  • Reload ip6h and iaddr in ILA_CSUM_ADJUST_TRANSPORT case.
  • Apply the Linux kernel patch for ila module.
References
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2026-68127.

URL Resource
https://git.kernel.org/stable/c/472aba2603ca74c4f7722cb0c0296942b0776b8d
https://git.kernel.org/stable/c/7097a0280b178237265681be66d1bef11d15894b
https://git.kernel.org/stable/c/896a9512d0d83c2a4b357e5585b7b62a8e3f95c1
https://git.kernel.org/stable/c/92d3817649df2b0b6a008a686c8275c88d7ef594
https://git.kernel.org/stable/c/c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-68127 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-68127 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-68127 vulnerability anywhere in the article.

Results are limited to the first 20 news articles due to potential performance issues.

The following table lists the changes that have been made to the CVE-2026-68127 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 17, 2026

    Action Type Old Value New Value
    Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '896a9512d0d83c2a4b357e5585b7b62a8e3f95c1', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '7097a0280b178237265681be66d1bef11d15894b', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '472aba2603ca74c4f7722cb0c0296942b0776b8d', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': 'c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '92d3817649df2b0b6a008a686c8275c88d7ef594', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ila/ila_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ila/ila_common.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '896a9512d0d83c2a4b357e5585b7b62a8e3f95c1', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '7097a0280b178237265681be66d1bef11d15894b', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '472aba2603ca74c4f7722cb0c0296942b0776b8d', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': 'c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '92d3817649df2b0b6a008a686c8275c88d7ef594', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ila/ila_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ila/ila_common.c'], 'defaultStatus': 'affected'}]
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 13, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Aug. 10, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '896a9512d0d83c2a4b357e5585b7b62a8e3f95c1', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '7097a0280b178237265681be66d1bef11d15894b', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '472aba2603ca74c4f7722cb0c0296942b0776b8d', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': 'c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc', 'versionType': 'git'}, {'status': 'affected', 'version': '33f11d16142b06588eedfc1dd8cf93790979a712', 'lessThan': '92d3817649df2b0b6a008a686c8275c88d7ef594', 'versionType': 'git'}], 'programFiles': ['net/ipv6/ila/ila_common.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '4.5'}, {'status': 'unaffected', 'version': '0', 'lessThan': '4.5', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.148', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.101', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.42', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.6', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc5', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv6/ila/ila_common.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer. Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists. Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.
    Added Reference https://git.kernel.org/stable/c/472aba2603ca74c4f7722cb0c0296942b0776b8d
    Added Reference https://git.kernel.org/stable/c/7097a0280b178237265681be66d1bef11d15894b
    Added Reference https://git.kernel.org/stable/c/896a9512d0d83c2a4b357e5585b7b62a8e3f95c1
    Added Reference https://git.kernel.org/stable/c/92d3817649df2b0b6a008a686c8275c88d7ef594
    Added Reference https://git.kernel.org/stable/c/c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS
Vulnerability Scoring Details
Base CVSS Score: 9.8
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality Impact
Integrity Impact
Availability Impact