CVE-2026-80792
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.
Affected versions
Linux kernel versions
5.10.233,
5.4.289,
5.15
and later are affected. Fixed in
5.10.267,
5.15.218,
6.1.185,
6.6.154,
6.12.106,
6.18.47,
7.1.11,
7.2.1,
7.3
and their respective stable series.
References
9 totalFrequently asked questions
-
What is CVE-2026-80792?
CVE-2026-80792 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.10.233 onward and has been patched in 5.10.267, 5.15.218, 6.1.185 and others. CVE-2026-80792 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-80792?
Yes. CVE-2026-80792 has been patched. Fixed versions include 5.10.267, 5.15.218, 6.1.185 and others. If you are running Linux kernel 5.10.233 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-80792 actively exploited?
No. CVE-2026-80792 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.