CVE-2026-68127

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ila: reload IPv6 header after pskb_may_pull in checksum adjust

ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling

pskb_may_pull(). On a non-linear skb whose transport header sits in a page

fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head()

and free the old skb head, leaving ip6h dangling; the following

get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator()

uses ip6h (and the iaddr derived from it) again after the csum-adjust

call and additionally writes the new locator through that pointer.

Impact: a remote IPv6 packet routed through a configured ILA

csum-adjust-transport route or receive-side mapping triggers a

slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or

mapping requires CAP_NET_ADMIN to configure, but trigger packets are

unauthenticated once it exists.

Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport()

bef

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References