CVE-2026-46172 (GCVE-0-2026-46172)
Vulnerability from cvelistv5
Published
2026-05-28 09:36
Modified
2026-06-14 18:00
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: xfrm6: release dst on error in xfrm6_rcv_encap() xfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not already have a dst attached. ip6_route_input_lookup() returns a referenced dst entry even when the lookup resolves to an error route. If dst->error is set, xfrm6_rcv_encap() drops the skb without attaching the dst to the skb and without releasing the reference returned by the lookup. Repeated packets hitting this path therefore leak dst entries. Release the dst before jumping to the drop path.
Impacted products
Vendor Product Version
Linux Linux Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Version: 0146dca70b877b73c5fd9c67912b8a0ca8a7bac7
Create a notification for this product.
Show details on NVD website


{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/xfrm6_protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a0721bcd72641c32b281f227a94505b31cf54117",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            },
            {
              "lessThan": "a20b34f6e854fe6f2aa82528fae7a88759919eb4",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            },
            {
              "lessThan": "870560015ce6e0d8f841c6a8aba33c44be52c727",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            },
            {
              "lessThan": "c2efc4956981066df2fef1cc77391b523db6d8e4",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            },
            {
              "lessThan": "554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            },
            {
              "lessThan": "9d5047782f9bd2829e529df69209bf3232eb561f",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            },
            {
              "lessThan": "6a5eec0a2a0e99ec9743cf8f1c4082178811d90a",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            },
            {
              "lessThan": "bc0fcb9823cd0894934cf968b525c575833d7078",
              "status": "affected",
              "version": "0146dca70b877b73c5fd9c67912b8a0ca8a7bac7",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/xfrm6_protocol.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.8"
            },
            {
              "lessThan": "5.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.140",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.88",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.30",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.7",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: xfrm6: release dst on error in xfrm6_rcv_encap()\n\nxfrm6_rcv_encap() performs an IPv6 route lookup when the skb does not\nalready have a dst attached. ip6_route_input_lookup() returns a\nreferenced dst entry even when the lookup resolves to an error route.\n\nIf dst-\u003eerror is set, xfrm6_rcv_encap() drops the skb without attaching\nthe dst to the skb and without releasing the reference returned by the\nlookup. Repeated packets hitting this path therefore leak dst entries.\n\nRelease the dst before jumping to the drop path."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-14T18:00:01.373Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a0721bcd72641c32b281f227a94505b31cf54117"
        },
        {
          "url": "https://git.kernel.org/stable/c/a20b34f6e854fe6f2aa82528fae7a88759919eb4"
        },
        {
          "url": "https://git.kernel.org/stable/c/870560015ce6e0d8f841c6a8aba33c44be52c727"
        },
        {
          "url": "https://git.kernel.org/stable/c/c2efc4956981066df2fef1cc77391b523db6d8e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/554c9b090c8ac5b1c5c507f4badf8d5d0c9c6e13"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d5047782f9bd2829e529df69209bf3232eb561f"
        },
        {
          "url": "https://git.kernel.org/stable/c/6a5eec0a2a0e99ec9743cf8f1c4082178811d90a"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc0fcb9823cd0894934cf968b525c575833d7078"
        }
      ],
      "title": "ipv6: xfrm6: release dst on error in xfrm6_rcv_encap()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-46172",
    "datePublished": "2026-05-28T09:36:26.926Z",
    "dateReserved": "2026-05-13T15:03:33.103Z",
    "dateUpdated": "2026-06-14T18:00:01.373Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.


Loading…

Loading…