CVE-2026-90111

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ip6mr: do not clone dst in ip6mr_cache_report()

IPv6 input attaches a non-refcounted (NOREF) dst to skbs under RCU.

When an ingress multicast packet misses MFC lookup,

ip6mr_cache_unresolved() places the skb onto the unresolved queue,

escaping the receive-side RCU grace period.

If the underlying route is deleted and freed, and the MFC queue is later

resolved with a wrong parent interface, ip6_mr_forward() invokes

ip6mr_cache_report(..., MRT6MSG_WRONGMIF), which executes

dst_clone(skb_dst(pkt)) on the freed dst entry, triggering a slab

use-after-free.

Report packets queued to mroute6_sk (a raw socket) and netlink

notifications do not require an attached dst entry.

Fix this by:

1. Removing dst_clone() in ip6mr_cache_report() and ensuring report skbs

do not hold a dst.

2. Dropping skb_dst before queuing unresolved skbs in

ip6mr_cache_unresolved(), matching the fact that multicast

forwarding resolves outgoing

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References