Skip to main content

Linux Kernel CVE-2026-46099

| EUVDEUVD-2026-32482 HIGH
Improper Update of Reference Count (CWE-911)
2026-05-27 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-9x88-7c3c-r34g
Information Disclosure Linux
8.1
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Identify PREEMPT_RT host with seg6/RPL lwtunnels
  2. Delivery
    Send IPv6 traffic through shared-nexthop route
  3. Exploit
    Induce concurrent FIB sernum bump
  4. Execution
    Win race between ip6_route_input and dst_cache_set_ip6
  5. Persist
    Trigger dst_hold on freed pcpu_rt
  6. Impact
    Kernel WARN, UAF, potential code execution

Vulnerability Assessment

Weakness
CWE
CWE-911
Exploitation Conditions

Target must run a Linux kernel built with CONFIG_PREEMPT_RT enabled and PREEMPT_RT_NEEDS_BH_LOCK disabled (the explicit kernel-configuration prerequisite called out in the upstream description), and must have IPv6 seg6 (SRv6) or RPL lightweight tunnel encapsulation routes configured such that two or more routes share the same fib6_nh nexthop (rt6i_pcpu entry). The attacker also needs to drive IPv6 traffic through those lwtunnel routes on the affected CPU and trigger or wait for a concurrent FIB lookup that calls rt_genid_bump_ipv6() to bump fib6_sernum, then win a narrow same-CPU race window between ip6_route_input() and dst_cache_set_ip6() inside ksoftirqd. Exploitation is limited by the high attack complexity (AC:H) reflecting this multi-step race, the niche PREEMPT_RT deployment footprint (telecom, industrial, automotive, low-latency systems), and the requirement that seg6 or RPL source routing be actively configured - default IPv6 routing without lwtunnels is not affected.
Impact

The CVSS 8.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects the worst-case use-after-free outcome, but the AC:H value and the description's PREEMPT_RT precondition tell a much more grounded story: exploitation requires a kernel built with PREEMPT_RT and without PREEMPT_RT_NEEDS_BH_LOCK, plus seg6 or RPL lwtunnel routes configured with shared nexthops, plus a precisely-timed race on the same CPU between ksoftirqd and a higher-priority task. EPSS at 0.02% (5th percentile) and the absence of any KEV listing or public PoC are consistent with this being a hardening/correctness fix rather than a hot exploitation target. The 'Information Disclosure' tag in the input conflicts with the CVSS C:H/I:H/A:H rating and the underlying UAF mechanics, which typically yield DoS or potential privilege escalation rather than info-leak - treat the tag as imprecise. Overall this is a low real-world priority for general-purpose distributions, and a higher priority specifically for real-time/embedded operators (telecom, industrial, automotive) running PREEMPT_RT kernels with SRv6 or RPL deployments.
Exploit ScenarioDerived

An attacker sends a stream of IPv6 packets traversing a PREEMPT_RT router that has seg6 or RPL lwtunnel routes configured with shared nexthops, while simultaneously inducing FIB churn (for example through routing protocol updates or local activity) that bumps fib6_sernum and invalidates per-CPU routes. With sufficient timing precision, ksoftirqd is preempted between ip6_route_input() and dst_cache_set_ip6() while another task releases the underlying pcpu_rt, causing dst_hold() on a freed object and yielding a kernel WARN, panic, or - in a worst case - memory corruption leveraged toward privilege escalation. No public proof-of-concept is identified at time of analysis.
This Week Schedule remediation this week. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Use-after-free in the Linux kernel's IPv6 SR (seg6) and RPL lightweight tunnel input paths can be triggered on PREEMPT_RT builds when a higher-priority task races ksoftirqd during a concurrent FIB lookup on a shared nexthop. The flaw causes dst_cache_set_ip6() to call dst_hold() on a freed per-CPU route, producing a kernel warning or memory corruption that an attacker on the network could leverage for denial of service or potential code execution. EPSS is very low (0.02%) and there is no public exploit identified at time of analysis.

RemediationAI

Upgrade to a fixed Linux kernel: mainline 7.1-rc2 or later, or stable 7.0.4, 6.18.27, 6.12.86, or 6.6.140 (per the EUVD record), pulling the seg6_input_core() and rpl_input() skb_dst_force() change referenced by the kernel.org stable commits listed in the references. Distribution users should track their vendor's kernel advisory and apply the next stable kernel update. As a compensating control until patched, disable or avoid configuring seg6 and RPL lightweight tunnel encapsulations on PREEMPT_RT hosts (remove 'encap seg6' and 'encap rpl' routes, and unload the seg6_iptunnel and rpl_iptunnel modules where feasible), which eliminates the vulnerable code path at the cost of losing SRv6/RPL source-routing functionality. Alternatively, building or running a kernel with PREEMPT_RT_NEEDS_BH_LOCK enabled, or switching off PREEMPT_RT entirely, closes the race window but sacrifices real-time latency guarantees and may not be acceptable in telecom, industrial or automotive deployments.

Affected VersionsENISA

Linux af4a2209b1344939eaac11f269c261d347cbc3ee <9dd5481f960e337b81d7dfe429529495c1c481c0
Linux patch: 7.1-rc2
Linux af4a2209b1344939eaac11f269c261d347cbc3ee <52f9db67f8f35f436366cf4980b4f0a2583d0ef0
Linux 4.12
Linux patch: 7.0.4
Linux patch: 6.18.27
Linux patch: 6.6.140
Linux af4a2209b1344939eaac11f269c261d347cbc3ee <6bd17925bd6866027a6555db17905b9fc073d38d
Linux af4a2209b1344939eaac11f269c261d347cbc3ee <b778b6d095421619c331fd2d7751143cd5387103
Linux patch: 0
Linux af4a2209b1344939eaac11f269c261d347cbc3ee <f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e
Linux patch: 6.12.86

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in net/ipv6/seg6_iptunnel.c (seg6_input_core) and net/ipv6/rpl_iptunnel.c (rpl_input), two IPv6 lightweight tunnel handlers that implement Segment Routing over IPv6 (SRv6, RFC 8754) and Routing Protocol for Low-power and Lossy Networks (RPL, RFC 6550) source routing. Both call ip6_route_input() with the RT6_LOOKUP_F_DST_NOREF flag, attaching a non-refcounted destination entry (NOREF dst) to the skb before passing that pointer into the dst_cache machinery via dst_hold(). On PREEMPT_RT kernels (without PREEMPT_RT_NEEDS_BH_LOCK) ksoftirqd is preemptible, and shared fib6_nh nexthops mean another task on the same CPU can run rt6_get_pcpu_route(), notice a stale fib6_sernum after a generation bump, xchg the per-CPU route to NULL and dst_release() it, dropping the refcount to zero. The fix forces the dst into a refcounted state via skb_dst_force() after ip6_route_input(). The root cause class is CWE-416 (Use After Free) arising from a TOCTOU between a NOREF route lookup and the subsequent dst_hold().

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY 8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.0 HIGH

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
8.1 (HIGH)
Patch available
May 27, 2026 - 19:46 EUVD
CVE Published
May 27, 2026 - 14:17 nvd
UNKNOWN (no severity yet)
CVE Published
May 27, 2026 - 14:17 nvd
HIGH 8.1

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels

seg6_input_core() and rpl_input() call ip6_route_input() which sets a NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking dst_hold() unconditionally. On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can release the underlying pcpu_rt between the lookup and the caching through a concurrent FIB lookup on a shared nexthop. Simplified race sequence:

ksoftirqd/X higher-prio task (same CPU X) ----------- -------------------------------- seg6_input_core(,skb)/rpl_input(skb) dst_cache_get() -> miss ip6_route_input(skb) -> ip6_pol_route(,skb,flags) [RT6_LOOKUP_F_DST_NOREF in flags] -> FIB lookup resolves fib6_nh [nhid=N route] -> rt6_make_pcpu_route() [creates pcpu_rt, refcount=1] pcpu_rt->sernum = fib6_sernum [fib6_sernum=W] -> cmpxchg(fib6_nh.rt6i_pcpu, NULL, pcpu_rt) [slot was empty, store succeeds] -> skb_dst_set_noref(skb, dst) [dst is pcpu_rt, refcount still 1]

rt_genid_bump_ipv6() -> bumps fib6_sernum [fib6_sernum from W to Z] ip6_route_output() -> ip6_pol_route() -> FIB lookup resolves fib6_nh [nhid=N] -> rt6_get_pcpu_route() pcpu_rt->sernum != fib6_sernum [W <> Z, stale] -> prev = xchg(rt6i_pcpu, NULL) -> dst_release(prev) [prev is pcpu_rt, refcount 1->0, dead]

dst = skb_dst(skb) [dst is the dead pcpu_rt] dst_cache_set_ip6(dst) -> dst_hold() on dead dst -> WARN / use-after-free

For the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without PREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release the pcpu_rt. Shared nexthop objects provide such a path, as two routes pointing to the same nhid share the same fib6_nh and its rt6i_pcpu entry.

Fix seg6_input_core() and rpl_input() by calling skb_dst_force() after ip6_route_input() to force the NOREF dst into a refcounted one before caching. The output path is not affected as ip6_route_output() already returns a refcounted dst.

Executive ViewAI

Why It Matters

A memory safety vulnerability in PREEMPT_RT Linux kernel builds (CVE-2026-46099) can trigger system crashes and enable potential code execution when IPv6 network packets race concurrent route lookups. Organizations deploying real-time Linux variants in critical infrastructure or networking systems face immediate availability and confidentiality risks without prompt remediation.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 95% exploitable
Threat Intel
1
1 sources
Data Quality
6 sources
Confidence: High
EUVD NVD CVE.org EPSS CISA MSRC Vendor VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Open
Automatable· derived
No
Human Impact
High

Priority Score

50
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +40
PoC: 0
Weaponized: 0
Threat intel: +10
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-911 – Improper Update of Reference Count

View all
CVE-2022-29581 HIGH POC
7.8
CVE-2026-46316 CRITICAL
9.3
CVE-2026-49419 HIGH
8.8
CVE-2026-52943 HIGH
7.8
CVE-2024-46972 HIGH
7.8
CVE-2023-5633 HIGH
7.8
CVE-2026-77587 HIGH
7.5
CVE-2023-22394 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Threat IntelligenceMISP

CISA Advisories
ICSA-26-295-16
Sources: Microsoft MSRC, CISA (public domain)

References

Advisories & patches
ADVISORY https://ubuntu.com/security/notices/USN-8488-1 ADVISORY https://ubuntu.com/security/notices/USN-8489-1 ADVISORY https://vuldb.com/vuln/366321 REF https://access.redhat.com/errata/RHSA-2026:45114 REF https://access.redhat.com/errata/RHSA-2026:59662 REF https://access.redhat.com/errata/RHSA-2026:59663 REF https://access.redhat.com/errata/RHSA-2026:62568 REF https://access.redhat.com/errata/RHSA-2026:64767 REF https://access.redhat.com/errata/RHSA-2026:65712 REF https://access.redhat.com/security/cve/CVE-2026-46099 REF https://bugzilla.redhat.com/show_bug.cgi?id=2481972 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/51fef5a7c4d160839199e941929456ba21ddf73c REF https://git.kernel.org/stable/c/52f9db67f8f35f436366cf4980b4f0a2583d0ef0 REF https://git.kernel.org/stable/c/6bd17925bd6866027a6555db17905b9fc073d38d REF https://git.kernel.org/stable/c/9dd5481f960e337b81d7dfe429529495c1c481c0 REF https://git.kernel.org/stable/c/b258b849a580285a1692e782ebc902b44c884a71 REF https://git.kernel.org/stable/c/b778b6d095421619c331fd2d7751143cd5387103 REF https://git.kernel.org/stable/c/f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-46099.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy