Ipv6
Monthly
Improper verification of the source of IPv6 Router Advertisements in Amazon FreeRTOS-Plus-TCP before V4.4.2 allows an unauthenticated attacker on the same local link to send crafted Router Advertisements and influence a device's IPv6 default gateway, on-link prefix, and address configuration, potentially redirecting or intercepting IPv6 traffic (assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Exploitation requires IPv6 Router Advertisement/autoconfiguration processing to be enabled and the attacker to be positioned on the same link, because RAs are link-local ICMPv6 multicast messages that are not routable; no authentication or user interaction is required. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE; the vendor has released patch V4.4.2.
Out-of-bounds memory access in the Linux kernel's IPv6 Segment Routing (SRv6) receive path can be triggered by remote, unauthenticated attackers who send a crafted IPv6 packet containing a Segment Routing Header (SRH) with segments_left > 0 that is preceded by another extension header such as a Hop-by-Hop options header. Because ipv6_srh_rcv() restores skb->data by pushing a fixed sizeof(struct ipv6hdr) instead of re-establishing the real network header, skb_network_offset() remains negative; that negative value is then consumed as an unsigned length by the flow dissector during ip6_route_input(), or by sch_fragment()/neighbour output when the packet is forwarded via ip6_forward() or redirected via act_mirred, producing an out-of-bounds memcpy or buffer overflow that can crash the kernel and corrupt memory. Exploitation is not automatic: the target must be built with CONFIG_IPV6_SEG6 and configured as an SRv6 endpoint, and the packet must be specifically structured, which is reflected in the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H; no public exploit code and no confirmed active exploitation were identified at time of analysis. Vendor fixes are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.
A use-after-free race in the Linux kernel's IPv6 FIB6 route-table walker lets a local user who can delete IPv6 routes free a seq private object while it is still linked on net->ipv6.fib6_walkers, after which a subsequent route deletion traverses the dangling list and dereferences the freed walker. The race is triggered by concurrently iterating the route table through /proc/net/ipv6_route or the BPF ipv6_route iterator while removing the last route at a FIB6 table root, and the BPF show path only widens the already non-deterministic window. Exploitation requires local access on an IPv6-enabled host, is timing-dependent, and typically needs route-deletion privileges (CAP_NET_ADMIN, sometimes reachable via unprivileged user namespaces); assessed impact is kernel memory corruption resulting in low integrity impact and high availability impact (crash/DoS), with potential privilege-escalation consequences in that local context. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in the referenced stable trees.
Use-after-free in the Linux kernel's IPv6 multicast routing (ip6mr) subsystem allows a local attacker who already holds CAP_NET_ADMIN to corrupt kernel memory by racing MFC (multicast forwarding cache) resolution against route deletion. The bug is reachable only when the kernel is built with IPv6 multicast routing support (CONFIG_IPV6_MROUTE) and a multicast routing daemon holds an mroute6_sk raw socket; an unresolved ingress multicast packet that escapes the receive-side RCU grace period can later be reported via the MRT6MSG_WRONGMIF path, where dst_clone() duplicates a dst entry that has already been freed by route deletion, yielding a slab use-after-free with high confidentiality and integrity impact. The vendor rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment keeps the same impact but raises attack complexity to High because of the required ordering and timing window; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist upstream in 7.2.6 and 7.3-rc1.
IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An issue was discovered in Treck IPv6 before 6.0.1.68. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Treck IPv6 before 6.0.1.68. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Treck IPv6 before 6.0.1.68. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Improper verification of the source of IPv6 Router Advertisements in Amazon FreeRTOS-Plus-TCP before V4.4.2 allows an unauthenticated attacker on the same local link to send crafted Router Advertisements and influence a device's IPv6 default gateway, on-link prefix, and address configuration, potentially redirecting or intercepting IPv6 traffic (assessed CVSS:3.1 vector AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L). Exploitation requires IPv6 Router Advertisement/autoconfiguration processing to be enabled and the attacker to be positioned on the same link, because RAs are link-local ICMPv6 multicast messages that are not routable; no authentication or user interaction is required. No public exploit code has been identified at time of analysis and CISA KEV does not list this CVE; the vendor has released patch V4.4.2.
Out-of-bounds memory access in the Linux kernel's IPv6 Segment Routing (SRv6) receive path can be triggered by remote, unauthenticated attackers who send a crafted IPv6 packet containing a Segment Routing Header (SRH) with segments_left > 0 that is preceded by another extension header such as a Hop-by-Hop options header. Because ipv6_srh_rcv() restores skb->data by pushing a fixed sizeof(struct ipv6hdr) instead of re-establishing the real network header, skb_network_offset() remains negative; that negative value is then consumed as an unsigned length by the flow dissector during ip6_route_input(), or by sch_fragment()/neighbour output when the packet is forwarded via ip6_forward() or redirected via act_mirred, producing an out-of-bounds memcpy or buffer overflow that can crash the kernel and corrupt memory. Exploitation is not automatic: the target must be built with CONFIG_IPV6_SEG6 and configured as an SRv6 endpoint, and the packet must be specifically structured, which is reflected in the assessed vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H; no public exploit code and no confirmed active exploitation were identified at time of analysis. Vendor fixes are available in Linux 6.12.111, 6.18.53, 7.2.7 and 7.3-rc2.
A use-after-free race in the Linux kernel's IPv6 FIB6 route-table walker lets a local user who can delete IPv6 routes free a seq private object while it is still linked on net->ipv6.fib6_walkers, after which a subsequent route deletion traverses the dangling list and dereferences the freed walker. The race is triggered by concurrently iterating the route table through /proc/net/ipv6_route or the BPF ipv6_route iterator while removing the last route at a FIB6 table root, and the BPF show path only widens the already non-deterministic window. Exploitation requires local access on an IPv6-enabled host, is timing-dependent, and typically needs route-deletion privileges (CAP_NET_ADMIN, sometimes reachable via unprivileged user namespaces); assessed impact is kernel memory corruption resulting in low integrity impact and high availability impact (crash/DoS), with potential privilege-escalation consequences in that local context. No public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available in the referenced stable trees.
Use-after-free in the Linux kernel's IPv6 multicast routing (ip6mr) subsystem allows a local attacker who already holds CAP_NET_ADMIN to corrupt kernel memory by racing MFC (multicast forwarding cache) resolution against route deletion. The bug is reachable only when the kernel is built with IPv6 multicast routing support (CONFIG_IPV6_MROUTE) and a multicast routing daemon holds an mroute6_sk raw socket; an unresolved ingress multicast packet that escapes the receive-side RCU grace period can later be reported via the MRT6MSG_WRONGMIF path, where dst_clone() duplicates a dst entry that has already been freed by route deletion, yielding a slab use-after-free with high confidentiality and integrity impact. The vendor rates this 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), while our independent assessment keeps the same impact but raises attack complexity to High because of the required ordering and timing window; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor-released fixes exist upstream in 7.2.6 and 7.3-rc1.
IPv6-in-IPv4 tunneling (RFC 4213) allows an attacker to spoof and route traffic via an exposed network interface. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
IPv4-in-IPv6 and IPv6-in-IPv6 tunneling (RFC 2473) do not require the validation or verification of the source of a network packet, allowing an attacker to spoof and route arbitrary traffic via an. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
An issue was discovered in Treck IPv6 before 6.0.1.68. Rated high severity (CVSS 7.1), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Treck IPv6 before 6.0.1.68. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in Treck IPv6 before 6.0.1.68. Rated medium severity (CVSS 5.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
An issue was discovered in the IPv6 protocol specification, related to ICMP Packet Too Big (PTB) messages. Rated high severity (CVSS 8.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.