Skip to main content

Linux Kernel CVE-2026-97602

| EUVDEUVD-2026-86733 HIGH
2026-09-25 Linux GHSA-82gw-3rjg-qh2p
Privilege Escalation Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Unprivileged local access with user/netns
  2. Delivery
    Create network namespace
  3. Exploit
    Inject IPv6 fragments into reassembly queue
  4. Execution
    Race fqdir teardown flush
  5. Persist
    Reuse stale metadata for OOB heap write
  6. Impact
    Groom heap corruption into privilege escalation

Vulnerability Assessment

Exploitation Conditions

Requires local code execution and, critically, availability of unprivileged user/network namespaces (the description names this as the enabling condition for the LPE), plus a reachable IPv6 fragment reassembly path. The attacker must win a race between fqdir_pre_exit()/fqdir teardown (namespace destruction) and concurrent IPv6 fragment reassembly to reuse stale reassembly metadata - this race window is the primary limiting factor. Limiting factors: local access only (AV:L), no remote reachability, dependency on kernels where unprivileged namespaces are permitted (many hardened/enterprise configs disable unprivileged user namespaces), IPv6 fragment processing being active, and unpatched kernel versions prior to the fixed 6.12.111/6.18.53/7.2.7/7.3-rc3 backports.
Impact

This is one of the more genuinely serious Linux kernel network flaws of its batch. Unlike typical crash-only fragment bugs, the description EXPLICITLY states the IPv6 heap corruption 'can be leveraged for local privilege escalation when unprivileged network namespaces are available' - a real memory-corruption LPE primitive, corroborated by a KASAN slab-out-of-bounds write on the skbuff_small_head cache. The provided CVSS is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); I largely agree on impact but the root cause is a race between fqdir teardown (namespace destruction) and inflight fragment reassembly, so AC:L understates the difficulty - AC:H is more honest, yielding roughly 7.0. No EPSS score, no CISA KEV listing, and no public exploit code are present in the provided data (the KASAN trace references a private reproducer task named 'poc/771', but that is not distributed code). Net assessment: a high-priority local kernel bug because it is a bona fide LPE vector reachable by unprivileged users where unprivileged user/network namespaces are enabled, but the local attack vector, the required race window, and the lack of confirmed in-the-wild exploitation keep it below the urgency of a remote unauthenticated RCE. No signals conflict on the network-vs-local question: both CVSS and description agree it is local.
Exploit ScenarioDerived

An unprivileged local user on a kernel with unprivileged user/network namespaces enabled creates a network namespace, floods IPv6 fragments into a reassembly queue, then triggers namespace/fqdir teardown to race the flush path. Winning the race leaves a queue reusing stale reassembly metadata so ip6_frag_reasm() writes past a 704-byte skb heap object; the resulting controlled heap corruption is groomed into a local privilege escalation. No public exploit code is included in the provided data, though the KASAN report indicates a working private reproducer exists.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.2% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Sep 25, 2026

Heap corruption in the Linux kernel's IPv6 fragment reassembly logic can be turned into local privilege escalation by a low-privileged local user (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H in our assessment) on systems where unprivileged user/network namespaces are enabled and IPv6 fragment processing is reachable. The flaw stems from a race during network-namespace teardown: fqdir_pre_exit() flushes the skbs held in incomplete fragment queues without marking those queues complete, so a fragment that acquired a reference just before high_thresh was cleared can reuse stale reassembly metadata, and ip6_frag_reasm() then applies an old nhoffset to a new skb, producing an out-of-bounds write (KASAN: slab-out-of-bounds in ipv6_frag_rcv / ip6_protocol_deliver_rcu against skbuff_small_head). Successful exploitation yields kernel heap corruption exploitable for elevation to root; the primary limiting factor is winning the race between fqdir teardown and concurrent reassembly, and no public exploit code or confirmed active exploitation has been identified at time of analysis. A separate side effect is that unflushed fragments can keep conntrack references alive past the per-net conntrack cleanup point.

RemediationAI

Vendor-released patches exist: upgrade to kernel 6.12.111, 6.18.53, 7.2.7, or 7.3-rc3 (or apply the corresponding stable commits b9d77f1652e79e58eac48430d0431c329137efcc, 7cb5f4643a7fcdbfbee1fad3cdfc678add62d378, bf3d6c44c84c57e8a4bb7f40ad95b64f9b0198ba, b824476c56a153934c67c9e0f873e1fd967743d6 via https://git.kernel.org/stable/), and confirm the running kernel matches after reboot, since this is a live kernel path. Because the vulnerability is only reachable when unprivileged user/network namespaces are permitted, a practical compensating control is to disable them with 'sysctl -w kernel.unprivileged_userns_clone=0' on Debian/Ubuntu-family kernels or 'sysctl -w user.max_user_namespaces=0' where supported; the trade-off is that this breaks rootless containers (Podman, rootless Docker), bubblewrap-based sandboxes, and browser sandboxing, so it is a short-term containment measure rather than a permanent fix. A second option is to deny IPv6 fragments reaching the reassembly path, e.g. 'ip6tables -A INPUT -f -j DROP' (or an equivalent nftables rule dropping fragmented IPv6 packets); this removes the race window but can break legitimate large/fragmented IPv6 traffic such as tunnels and PMTU-sensitive flows, and it should be validated against production traffic before rollout. Disabling IPv6 entirely on hosts that do not need it removes the attack surface at the cost of losing IPv6 connectivity; none of these workarounds address the conntrack reference-leak component, which is resolved only by the kernel patch.

Affected VersionsENISA

Linux 6.6.143 <6.7
Linux 006a5035b495dec008805df249f92c22c89c3d2e <b824476c56a153934c67c9e0f873e1fd967743d6
Linux patch: 6.12.111
Linux patch: 7.2.7
Linux 006a5035b495dec008805df249f92c22c89c3d2e <bf3d6c44c84c57e8a4bb7f40ad95b64f9b0198ba
Linux 543555954b1ee8d1903a7020324efb41b0c97428 <b9d77f1652e79e58eac48430d0431c329137efcc
Linux 6.18.3 <6.18.53
Linux c70df25214ac9b32b53e18e6ae3b8f073ffa6903 <7cb5f4643a7fcdbfbee1fad3cdfc678add62d378
Linux 6.19
Linux 22ee4010866da81aeee08e1ea3fddbe418feb212
Linux patch: 7.3-rc3
Linux 6.12.93 <6.12.111
Linux patch: 6.18.53
Linux patch: 0

Affected Packages

euvd linux fix: 6.7, 6.12.111, 6.18.53

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The affected subsystem is the IP fragment reassembly machinery shared by IPv4 and IPv6 (net/ipv4/inet_fragment.c, net/ipv6/reassembly.c), which stores per-namespace fragment queues in an rhashtable owned by a struct fqdir. Each queue carries state flags such as INET_FRAG_COMPLETE and INET_FRAG_HASH_DEAD plus reassembly metadata (notably the offset/nhoffset tracking used to place payloads). On namespace exit, fqdir_pre_exit() flushes queued skbs from incomplete queues but does not transition those queues out of their incomplete state, so a concurrent fragment handler can still acquire the queue lock and operate on stale metadata. A queue killed after fqdir->dead is set can alternatively end up INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while still holding old skbs; because it is treated as complete, those skb references are skipped and survive until asynchronous fqdir teardown. In the IPv6 path, ip6_frag_reasm() can then combine the stale nhoffset with a freshly supplied skb and write past the end of an skbuff_small_head allocation, as captured in the KASAN report (write of size 1 and subsequent read at the object boundary, call chain ipv6_rcv -> ip6_input_finish -> ip6_protocol_deliver_rcu -> ipv6_frag_rcv). The upstream fix changes the teardown order: each incomplete queue is killed first, then every queue still owned by the dying rhashtable (identified by HASH_DEAD) is flushed, while complete queues lacking HASH_DEAD are left to their other destroy path; the timer reference dropped by inet_frag_kill() is released later in inet_frag_putn() after the queue lock is dropped. No CWE was supplied in the input, but the class is a race-condition-driven use of stale state leading to an out-of-bounds write (use-after-free/stale-metadata family).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI 7.0 HIGH

Local unprivileged trigger via namespaces (AV:L/PR:L); AC:H for the teardown-vs-reassembly race window; full C/I/A because the OOB heap write is an explicit local privilege-escalation primitive.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE 7.0 HIGH
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Red Hat 7.0 MEDIUM

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
Sep 25, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Sep 25, 2026 - 11:02 EUVD
CVE Published
Sep 25, 2026 - 10:22 cve.org
HIGH 7.8
CVE Published
Sep 25, 2026 - 10:22 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

inet: frags: invalidate queues before flushing them

fqdir_pre_exit() flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before high_thresh was cleared can then acquire the queue lock and reuse stale reassembly metadata. A queue concurrently killed after fqdir->dead is set can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while still holding its old skbs; skipping it because it is complete leaves those references behind until asynchronous fqdir teardown.

For IPv6, stale metadata can make ip6_frag_reasm() use the old nhoffset with a new skb and access memory out of bounds. The resulting heap corruption can be leveraged for local privilege escalation when unprivileged network namespaces are available. Unflushed fragments can also keep conntrack references alive after the conntrack per-net cleanup point.

Kill each incomplete queue, then flush every queue still owned by the dying rhashtable. HASH_DEAD identifies that ownership, while complete queues without it are already owned by another destroy path and must be left alone. Releasing a timer reference removed by inet_frag_kill() is deferred to inet_frag_putn(), after the queue lock is dropped.

KASAN report:

BUG: KASAN: slab-out-of-bounds in ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) Write of size 1 at addr ff110001039c6e00 by task poc/771 Call Trace: ? ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479 (discriminator 5)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) The buggy address belongs to the object at ff110001039c6b40 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 0 bytes to the right of allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)

BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) Read of size 1 at addr ff110001039c6e08 by task poc/771 Call Trace: ? ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) packet_sendmsg (net/packet/af_packet.c:2959 net/packet/af_packet.c:3053 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) The buggy address belongs to the object at ff110001039c6b40 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 8 bytes to the right of allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)

Executive ViewAI

Why It Matters

Linux kernel systems that enable unprivileged user and network namespaces face a local privilege-escalation flaw in IPv6 fragment reassembly, enabling a low-privileged local user to gain root-level control and compromise the host. Leadership should prioritize remediation because full system compromise can lead to data theft, service disruption, and lateral movement, especially in multi-tenant or containerized environments. Patch available per vendor advisory, so timely kernel updates are the most effective risk reduction.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.2%
Top 96% exploitable
Prevalence
Ubiquitous
Linux kernel IPv6 stack, present in effectively all Linux deployments
Data Quality
4 sources
Confidence: Medium
EUVD NVD CVE.org EPSS MSRC Vendor

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.2%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
None
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

39
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +39
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

References

Advisories & patches
ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-97602 REF https://git.kernel.org/stable/c/7cb5f4643a7fcdbfbee1fad3cdfc678add62d378 REF https://git.kernel.org/stable/c/b824476c56a153934c67c9e0f873e1fd967743d6 REF https://git.kernel.org/stable/c/b9d77f1652e79e58eac48430d0431c329137efcc REF https://git.kernel.org/stable/c/bf3d6c44c84c57e8a4bb7f40ad95b64f9b0198ba REF https://git.kernel.org/stable/c/ff83367cda8eefbd62007ef1dff4f8104226d18a

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy