EUVD-2026-76474
GHSA-7pg6-vmqr-62jx
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
IPv6 tunnels must be explicitly configured and attacker must trigger a specific post-reallocation error branch, justifying AC:H over AC:L.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()
ip6_tnl_xmit() may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skb_realloc_headroom(), copies skb->sk ownership, consumes the original skb, and then continues processing with the replacement skb kept only in its local variable.
That is safe only if the helper cannot fail afterwards. But this helper still has post-reallocation error exits. collect_md tunnels reject non-NONE encap after the replacement, and ip6_tnl_encap() can also fail later. In those cases the helper returns an error to its callers while the caller still only has the original skb pointer.
Both ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on error, so they can end up freeing an skb that ip6_tnl_xmit() already consumed.
Use skb_cow_head() instead. It provides the required headroom and writability without privately replacing the caller-owned skb, so later error returns cannot leave callers with a stale pointer.
The Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING and already call skb_cow_head() before entering ip6_tnl_xmit(). They do not rely on the removed skb_shared() reallocation. This also makes the IPv6 tunnel path consistent with ip_tunnel_xmit().
AnalysisAI
Double-free vulnerability in the Linux kernel's IPv6 tunnel driver (ip6_tunnel) allows a local attacker with low privileges to corrupt kernel memory, potentially leading to privilege escalation or system crash. The flaw exists in ip6_tnl_xmit(), where skb_realloc_headroom() internally consumes the original socket buffer but error-handling paths in ip6_tnl_start_xmit() and IPv6 GRE callers subsequently attempt to free it again. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following: (1) the target system must have IPv6 tunnel interfaces active - specifically ip6gre, ip6erspan, or ip6_tnl type tunnels (not default on most distributions; requires explicit ip link add or equivalent); (2) the attacker must have local shell access with at least the ability to send packets through those tunnels (CAP_NET_RAW or equivalent, typically available to PR:L users in non-hardened environments); (3) the attacker must reliably force the error path in ip6_tnl_xmit() after skb_realloc_headroom() succeeds - either by operating through a collect_md tunnel with a non-NONE encapsulation type, or by causing ip6_tnl_encap() to return an error. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (7.8) is reasonable in direction but likely overstates exploitability: AC:L does not capture that the attacker must (a) have IPv6 tunnels configured on the host and (b) reliably trigger the specific post-reallocation error path, both of which are non-trivial. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update to a patched stable kernel: Linux 6.12.109, 6.18.50, or 7.2.4, or any release based on 7.3-rc1 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all Linux systems in your environment for IPv6 tunnel driver usage (ip6_tunnel module) and current kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today