EUVD-2026-64534
GHSA-2fqw-fh97-qvmc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Network-reachable and unauthenticated (AV:N/PR:N) but requires a non-default ip6ip6 tunnel plus crafted HAO and malformed inner header (AC:H); skb corruption most reliably yields DoS (A:H) with limited C/I.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: clear skb2->cb[] in ip6ip6_err()
ip6ip6_err() clones an outer IPv6 ICMP error skb, pulls it to the quoted inner IPv6 packet, and then passes the clone to icmpv6_send(). The clone still carries the outer packet's inet6_skb_parm in skb->cb.
If the outer packet had a Home Address Option, IP6CB(skb2)->dsthao remains non-zero after skb_pull(). icmpv6_send() later calls mip6_addr_swap(), which uses that stale dsthao offset against the quoted inner packet. A malformed inner destination-options header can then make the HAO lookup and address swap run past the end of the quoted packet and corrupt skb_shared_info.
Clear skb2->cb[] before pulling the quoted inner IPv6 packet so the reply path does not reuse metadata left by the outer IPv6 stack.
AnalysisAI
Kernel-memory corruption in the Linux IPv6-in-IPv6 tunnel driver (ip6_tunnel) lets a remote attacker corrupt skb_shared_info by abusing stale socket control-block metadata during ICMPv6 error handling. Affected systems are Linux hosts terminating an ip6ip6 tunnel where an outer ICMPv6 error carrying a Home Address Option is reflected back through icmpv6_send(); a malformed inner destination-options header then drives an out-of-bounds Home Address Option lookup/swap past the quoted packet. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the target Linux host to be running an IPv6-in-IPv6 (ip6ip6) tunnel so that ip6ip6_err() handles the inbound ICMPv6 error, and requires the outer ICMPv6 error packet to carry a Mobile IPv6 Home Address Option (so IP6CB->dsthao is set) plus a malformed inner IPv6 destination-options header in the quoted packet to steer the out-of-bounds Home Address Option lookup. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and should be weighed carefully. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker on the network path to a Linux host that terminates an ip6ip6 tunnel sends a crafted ICMPv6 error whose quoted inner IPv6 packet carries a malformed destination-options header, while the outer packet includes a Home Address Option. When the kernel reflects the error through icmpv6_send()/mip6_addr_swap() using the stale dsthao offset, the out-of-bounds address swap corrupts skb_shared_info, most likely crashing the kernel (DoS) and potentially enabling memory disclosure or corruption. … |
| Remediation | Upstream fix available (stable commits); update to a patched kernel for your series - 5.10.265, 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, or 7.1.9/7.2 or later - via your distribution's kernel update and reboot (or livepatch where supported). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, conduct an inventory of all Linux systems configured with ip6ip6 tunnel deployments to quantify exposure. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today