CVE-2026-80792

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix use-after-free in ip6_finish_output2()

ip6_finish_output2() caches a pointer to the IPv6 destination

address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF

transmit path or other encapsulation operations within

lwtunnel_xmit() can reallocate the skb head, freeing the memory

that daddr points to. When lwtunnel_xmit() returns

LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale

daddr pointer to compute the nexthop and to look up or create the

neighbour entry. This results in a use-after-free read, which can

leak sensitive kernel data, pollute the neighbour table with

arbitrary values, misdirect traffic, or crash the system.

Fix this by re-fetching the IPv6 header and the destination

address pointer after lwtunnel_xmit() returns

LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop

computation and neighbour lookup operate on valid memory.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References