CVE-2026-97472 (GCVE-0-2026-97472)
Vulnerability from cvelistv5
Published
2026-09-24 16:04
Modified
2026-10-03 10:58
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: fix temp address generation after prefix deprecation When a router temporarily deprecates an IPv6 prefix (either by sending a Router Advertisement with Preferred Lifetime = 0 or by letting the lifetime expire) and later restores it, the kernel permanently loses its ability to generate temporary privacy addresses (RFC 8981) for that prefix. This happens because the address worker attempts to generate a replacement temporary address when the current one nears expiration. As the base prefix is deprecated already, the generation fails after marking the temporary address as already having spawned a replacement (ifp->regen_count++). When the router eventually restores the prefix, the temporary address becomes active again. However, once it naturally expires, the address worker sees this temporary address already tried to generate one and skips the regeneration. Fix the issue by resetting the regen_count check of the latest temp address generated for the prefix updated by the incoming RA.
References
Impacted products
Vendor Product Version
Linux Linux Version: 76f793e3a47139d340185cbc1a314740c09b13d3
Version: 76f793e3a47139d340185cbc1a314740c09b13d3
Version: 76f793e3a47139d340185cbc1a314740c09b13d3
Version: 76f793e3a47139d340185cbc1a314740c09b13d3
Version: 76f793e3a47139d340185cbc1a314740c09b13d3
Version: 76f793e3a47139d340185cbc1a314740c09b13d3
Version: 76f793e3a47139d340185cbc1a314740c09b13d3
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b00f7c1da82a809156f785ed37536c2d2584927d",
              "status": "affected",
              "version": "76f793e3a47139d340185cbc1a314740c09b13d3",
              "versionType": "git"
            },
            {
              "lessThan": "6da8ba900b85e6478e211427630c67595fb707a4",
              "status": "affected",
              "version": "76f793e3a47139d340185cbc1a314740c09b13d3",
              "versionType": "git"
            },
            {
              "lessThan": "4f7d2a8dc364c4e55d0a1533451339008512933f",
              "status": "affected",
              "version": "76f793e3a47139d340185cbc1a314740c09b13d3",
              "versionType": "git"
            },
            {
              "lessThan": "f601ec5c92b3260c742f27a5d2fd289e30ae798f",
              "status": "affected",
              "version": "76f793e3a47139d340185cbc1a314740c09b13d3",
              "versionType": "git"
            },
            {
              "lessThan": "bff7b87dfa28a1502c18d0c6f1fadda5162fa854",
              "status": "affected",
              "version": "76f793e3a47139d340185cbc1a314740c09b13d3",
              "versionType": "git"
            },
            {
              "lessThan": "4df5597c65446135362f72880995e8920f058fa0",
              "status": "affected",
              "version": "76f793e3a47139d340185cbc1a314740c09b13d3",
              "versionType": "git"
            },
            {
              "lessThan": "e20d8922aa8fe441d291364c96c2179a005b79ea",
              "status": "affected",
              "version": "76f793e3a47139d340185cbc1a314740c09b13d3",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv6/addrconf.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.2"
            },
            {
              "lessThan": "3.2",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.2",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv6: addrconf: fix temp address generation after prefix deprecation\n\nWhen a router temporarily deprecates an IPv6 prefix (either by sending a\nRouter Advertisement with Preferred Lifetime = 0 or by letting the\nlifetime expire) and later restores it, the kernel permanently loses its\nability to generate temporary privacy addresses (RFC 8981) for that\nprefix.\n\nThis happens because the address worker attempts to generate a\nreplacement temporary address when the current one nears expiration. As\nthe base prefix is deprecated already, the generation fails after\nmarking the temporary address as already having spawned a replacement\n(ifp-\u003eregen_count++).\n\nWhen the router eventually restores the prefix, the temporary address\nbecomes active again. However, once it naturally expires, the address\nworker sees this temporary address already tried to generate one and\nskips the regeneration.\n\nFix the issue by resetting the regen_count check of the latest temp\naddress generated for the prefix updated by the incoming RA."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-03T10:58:42.012Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b00f7c1da82a809156f785ed37536c2d2584927d"
        },
        {
          "url": "https://git.kernel.org/stable/c/6da8ba900b85e6478e211427630c67595fb707a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f7d2a8dc364c4e55d0a1533451339008512933f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f601ec5c92b3260c742f27a5d2fd289e30ae798f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bff7b87dfa28a1502c18d0c6f1fadda5162fa854"
        },
        {
          "url": "https://git.kernel.org/stable/c/4df5597c65446135362f72880995e8920f058fa0"
        },
        {
          "url": "https://git.kernel.org/stable/c/e20d8922aa8fe441d291364c96c2179a005b79ea"
        }
      ],
      "title": "ipv6: addrconf: fix temp address generation after prefix deprecation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97472",
    "datePublished": "2026-09-24T16:04:14.951Z",
    "dateReserved": "2026-09-24T16:01:01.148Z",
    "dateUpdated": "2026-10-03T10:58:42.012Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.