CVE-2026-80792
ipv6: fix use-after-free in ip6_finish_output2()
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.
INFO
Published Date :
Sept. 4, 2026, 4:18 p.m.
Last Modified :
Sept. 4, 2026, 4:18 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Update the Linux kernel to incorporate the fix.
- Re-fetch IPv6 header after lwtunnel_xmit() returns.
- Re-fetch destination address after lwtunnel_xmit() returns.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-80792.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-80792 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-80792
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-80792 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-80792 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Sep. 04, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory. Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/80xxx/CVE-2026-80792.json">CVE-2026-80792</a> Added Reference https://git.kernel.org/stable/c/087ee0d914aaae929f1660c9ca878e367655ba1a Added Reference https://git.kernel.org/stable/c/3c770ac4e6f07af7c7b40c474a3efc61ffed7862 Added Reference https://git.kernel.org/stable/c/3dc98e5fe82d069dd29b124ffbdb679331dfea43 Added Reference https://git.kernel.org/stable/c/73a187384a8c8b983c7fea046d716b6752a1e7a3 Added Reference https://git.kernel.org/stable/c/75e0a544ebe9af663ef53ca21e9e9185c51fb54a Added Reference https://git.kernel.org/stable/c/99219c82804f266189388e8bf1cf5135d10d5515 Added Reference https://git.kernel.org/stable/c/c95f01b78266828a57060d754fcbfc92123a98ed Added Reference https://git.kernel.org/stable/c/d0d48d999b0eee6bb176ef4e39d9be868fa80f7e Added Reference https://git.kernel.org/stable/c/d960881b9312e781a3429aabceb223ce6b7c882f