EUVD-2026-59545
GHSA-jvq3-c9fm-53r7
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitation needs local ability to drive IPv6 address state (PR:L) and winning a tight race (AC:H); grounded in the crash trace the realistic impact is a kernel panic (A:H), with no confirmed confidentiality/integrity loss.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD
addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list).
addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry:
general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40
Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp->lock critical section. The STABLE_PRIVACY branch temporarily drops ifp->lock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released.
AnalysisAI
Denial of service (and potential memory corruption) in the Linux kernel IPv6 stack arises from a race condition in addrconf_dad_failure() where ifp->lock is transiently dropped, letting a concurrent ipv6_del_addr() poison a list entry that Duplicate Address Detection (DAD) work then dereferences, producing a general protection fault in ipv6_del_addr(). The flaw affects the addrconf DAD-failure path across a broad range of kernel versions and is fixed by folding the state transition into a single locked critical section. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two events to interleave: a DAD (Duplicate Address Detection) failure on an IPv6 interface address AND a concurrent ipv6_del_addr() on that same address, so the attacker must be able to both induce address collisions/DAD failures and add/remove IPv6 addresses - typically local privileges such as CAP_NET_ADMIN or an adjacent host on the link able to spoof duplicate addresses. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict sharply and should be reconciled before triage. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A local attacker with the ability to manipulate IPv6 addresses (e.g. inside a container granted CAP_NET_ADMIN) repeatedly forces a DAD failure on an interface address while a second thread races to delete the same address, hitting the narrow unlocked window in addrconf_dad_failure(). … |
| Remediation | Vendor-released patch: update to a fixed stable kernel - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, or 7.1.5 (7.2-rc1 upstream) or later within your series - sourced from your distribution's kernel package rather than compiling if possible, then reboot to load the patched kernel. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan all Linux systems to identify kernel versions and assess exposure, prioritizing Internet-facing systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allVendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today