EUVD-2026-64003
GHSA-7ph7-58w3-w755
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Trigger needs non-default IPv6 suppress FIB rules configured, so AC:H; realistic impact is a kernel-crash use-after-free (A:H) with no confirmed confidentiality/integrity effect.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
net: ipv6: clear suppressed fib6 rule result
fib6_rule_suppress() drops a suppressed route with ip6_rt_put_flags(), but leaves res->rt6 pointing at the released rt6_info.
If no later rule supplies a replacement, fib6_rule_lookup() still sees res.rt6 and returns that stale dst to its caller. A suppressing rule can therefore leak a released route back to rt6_lookup(), and the next put hits rcuref_put_slowpath() from dst_release().
Clear res->rt6 when suppressing the route so suppressed lookups fall through to the null dst instead of reusing the released one.
AnalysisAI
Kernel-level use-after-free in the Linux IPv6 policy-routing (fib6 rules) subsystem allows a suppressed route to leak a released rt6_info back to rt6_lookup() callers, so a subsequent dst_release() operates on freed memory. The flaw affects systems using IPv6 FIB rules with route suppression and realistically manifests as a kernel crash (denial of service) and potential memory corruption. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the target system to run IPv6 and to have a policy-routing FIB rule with a suppress action configured (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals conflict and should be reconciled before prioritization. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | On a router or host configured with IPv6 policy routing that includes a suppress rule, an attacker (or ordinary traffic) triggers an IPv6 route lookup whose best candidate is suppressed with no later rule providing a replacement. The lookup returns the just-freed dst, and the following dst_release() dereferences freed memory, panicking the kernel or corrupting the dst slab. … |
| Remediation | Vendor-released patch: upgrade to a fixed stable release for your branch - 5.10.265, 5.15.216, 6.1.183, 6.6.151, 6.12.103, 6.18.44, or 7.1.8/7.2 as applicable - which add the res->rt6 clear in fib6_rule_suppress(). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify Linux systems affected by this vulnerability using vendor guidance on vulnerable kernel versions and IPv6 configuration requirements. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today