CVE-2026-23010

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: Fix use-after-free in inet6_addr_del().

syzbot reported use-after-free of inet6_ifaddr in

inet6_addr_del(). [0]

The cited commit accidentally moved ipv6_del_addr() for

mngtmpaddr before reading its ifp->flags for temporary

addresses in inet6_addr_del().

Let's move ipv6_del_addr() down to fix the UAF.

[0]:

BUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117

Read of size 4 at addr ffff88807b89c86c by task syz.3.1618/9593

CPU: 0 UID: 0 PID: 9593 Comm: syz.3.1618 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025

Call Trace:

<TASK>

__dump_stack lib/dump_stack.c:94 [inline]

dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120

print_address_description mm/kasan/report.c:378 [inline]

print_report+0xcd/0x630 mm/kasan/report.c:482

kasan_report+0xe0/0x110 mm/kasan/report.c:595

inet6_addr_del.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References