Skip to main content

Linux Kernel CVE-2026-68127

| EUVDEUVD-2026-55508 CRITICAL
2026-08-10 Linux GHSA-4hwh-2g43-5522
Information Disclosure Linux Suse
Critical
Disputed · 9.8 Vendor: Linux
Share

Severity by source

Sources disagree (Medium–Critical)
Vendor (Linux) PRIMARY
9.8 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
6.5 MEDIUM

Remote unauthenticated trigger packets (AV:N/PR:N) but requires non-default ILA config plus a fragmented-skb race (AC:H); impact is primarily use-after-free crash (A:H) with limited integrity, not demonstrated confidentiality.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.9 MEDIUM
AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
Red Hat
5.5 MEDIUM
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 14, 2026 - 02:23 vuln.today
CVSS changed
Aug 13, 2026 - 23:37 NVD
9.8 (CRITICAL)
Patch available
Aug 10, 2026 - 14:18 EUVD
CVE Published
Aug 10, 2026 - 11:58 cve.org
CRITICAL 9.8
CVE Published
Aug 10, 2026 - 11:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ila: reload IPv6 header after pskb_may_pull in checksum adjust

ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer.

Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists.

Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.

AnalysisAI

Slab use-after-free in the Linux kernel's ILA (Identifier Locator Addressing) IPv6 module allows a remote attacker to trigger memory corruption by sending crafted IPv6 packets through a configured ILA csum-adjust-transport route or receive-side mapping. The flaw stems from ila_csum_adjust_transport() and ila_update_ipv6_locator() caching a stale IPv6 header pointer across a pskb_may_pull() call that can reallocate the skb head, leading to reads and a locator write through freed memory. No public exploit is identified at time of analysis, and EPSS exploitation probability is low (0.18%); the issue is patched upstream.

Technical ContextAI

ILA (Identifier Locator Addressing) is a Linux networking feature (net/ipv6/ila) that rewrites the locator portion of IPv6 destination addresses to support network virtualization and identifier/locator separation, optionally adjusting transport-layer checksums via the CSUM_ADJUST_TRANSPORT mode. The bug is a classic non-linear skb pointer-lifetime error: pskb_may_pull() may invoke __pskb_pull_tail()/pskb_expand_head(), which can free and reallocate the skb head when the transport header lives in a page fragment. The code caches ip6h = ipv6_hdr(skb) before that pull, so the subsequent get_csum_diff() read and the ila_update_ipv6_locator() destination-address write dereference a dangling pointer. Although the vendor tags this Information Disclosure and CWE is not assigned, the root cause is CWE-416 (Use After Free); the fix reloads ip6h (and the derived iaddr) after each pskb_may_pull() in the CSUM_ADJUST_TRANSPORT path, while neutral-map modes that never pull retain their cached pointers safely.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.148, 6.12.101, 6.18.42, 7.1.6, or 7.2-rc5 (or later within each series), which reload the IPv6 header after each pskb_may_pull() in ila_csum_adjust_transport() and ila_update_ipv6_locator(); the corresponding stable commits are linked at git.kernel.org (e.g. https://git.kernel.org/stable/c/896a9512d0d83c2a4b357e5585b7b62a8e3f95c1). Where immediate patching is not possible, the most effective compensating control is to avoid the vulnerable code path entirely: do not configure ILA csum-adjust-transport routes or receive-side mappings, and remove any existing ones, since the bug is unreachable without them - the trade-off is loss of ILA checksum-neutral transport functionality on those hosts. Additionally restrict CAP_NET_ADMIN so untrusted operators cannot add such routes, and where ILA is unused, blacklist the ila kernel module to prevent it from loading.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-68127 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy