CVE-2026-46172

What it actually does

This is a Linux kernel denial-of-service flaw in the IPv6 XFRM/IPsec receive path. When xfrm6_rcv_encap() performs an IPv6 route lookup for an encapsulated packet and the lookup returns an error route, the function drops the packet without releasing the referenced destination cache entry. Repeatedly exercising this path leaks dst references, causing growth in kernel networking memory such as IPv6 destination-cache slab usage. Over time, this can exhaust kernel memory or networking resources and degrade or crash the affected system.

Why it matters to the business

Successful exploitation can make Linux systems that process affected IPv6 XFRM/IPsec traffic unstable or unavailable, potentially disrupting VPN, IPsec, gateway, container host, or server workloads that rely on the affected kernel. The issue is not currently listed in CISA KEV, has no known public exploit maturity in the supplied data, and has a low EPSS score, so broad internet-scale exploitation appears less likely; however, systems with exposed or reachable IPv6/IPsec processing paths should still treat it as an availability risk.

How an attack unfolds

An attacker needs the ability to send or generate traffic that reaches the affected IPv6 XFRM encapsulation receive path on a vulnerable Linux kernel. The attacker crafts repeated packets that cause xfrm6_rcv_encap() to perform an IPv6 route lookup where the result is an error route. Because the vulnerable code drops the packet without releasing the destination reference, each packet can leave behind an unreleased dst entry. By sustaining this traffic, the attacker gradually consumes kernel memory associated with routing/destination cache structures until the host experiences memory pressure, packet processing failures, service degradation, or a denial of service.

How to fix it

Upgrade the Linux kernel to a version that includes the upstream fix for releasing the dst reference before dropping the packet in xfrm6_rcv_encap(). No exact fixed package versions were provided in the input, so use the fixed kernel builds from the operating system or distribution vendor advisories for CVE-2026-46172. Where immediate patching is not possible, reduce exposure by limiting access to IPsec/XFRM and IPv6 packet-processing paths, disabling unused IPv6 or IPsec/XFRM functionality where operationally safe, restricting untrusted local users or workloads that can generate crafted traffic, and applying network controls to limit untrusted encapsulated IPv6 traffic.

How to confirm the fix worked

Confirm the running kernel version and vendor package release include the fix for the IPv6 xfrm6_rcv_encap() dst reference leak. Validate that all booted systems are running the patched kernel, not merely that the package is installed. On representative systems, monitor /proc/slabinfo for abnormal growth in IPv6 destination-cache-related slabs such as ip6_dst_cache under traffic conditions. Review kernel logs for memory pressure, OOM events, or networking resource exhaustion before and after remediation. If safe in a test environment, reproduce the pre-patch traffic condition and verify that destination-cache objects no longer grow without bound after the patched kernel is installed.

Typical attack path

1. Identify a Linux system running a vulnerable kernel with IPv6 XFRM/IPsec processing enabled or reachable.
2. Obtain local low-privileged execution or another position capable of generating traffic into the vulnerable receive path, consistent with the assigned local attack vector.
3. Send repeated IPv6 encapsulated/XFRM-related packets that trigger route lookups resolving to error routes.
4. Cause xfrm6_rcv_encap() to drop packets without releasing referenced dst entries.
5. Continue the packet stream until leaked kernel networking objects create memory pressure or resource exhaustion.
6. Observe service instability, degraded network processing, or host-level denial of service.

How to detect it

To investigate possible prior exploitation, focus on Linux hosts that process IPv6 XFRM/IPsec traffic or allow untrusted local users/workloads to generate such traffic. Review kernel logs, system journals, and monitoring data for unexplained memory pressure, OOM killer activity, service restarts, packet-processing degradation, or host instability correlated with spikes in IPv6/IPsec or encapsulated traffic. Examine /proc/slabinfo, historical node exporter metrics, eBPF telemetry, or kernel memory dashboards for unusual growth in IPv6 destination-cache-related slabs, especially ip6_dst_cache, without a corresponding legitimate traffic explanation. Network telemetry may show repetitive IPv6 encapsulated or IPsec-related traffic that results in routing errors or drops. Because the vulnerability is a resource leak rather than code execution, durable forensic artifacts may be limited; absence of malware or persistent files does not rule out exploitation.

• xfrm6_rcv_encap
• ip6_route_input_lookup
• ip6_dst_cache
• Out of memory: Killed process
• Memory cgroup out of memory
• kernel: Out of memory
• oom-killer
• invoked oom-killer
• dst->error
• IPv6:
• xfrm6

What your security team should do

• Prioritize patching Linux systems that use IPv6, IPsec, XFRM, VPN gateways, network appliances, container hosts, or multi-user workloads where untrusted users can generate local network traffic.
• Confirm patched kernels are actually running after maintenance windows by checking the active kernel version on each host.
• If patching is delayed, disable unused IPv6 or IPsec/XFRM features where feasible and restrict access to systems or namespaces that can generate affected traffic.
• Add monitoring for abnormal kernel memory growth, ip6_dst_cache slab growth, OOM events, and sudden degradation in IPv6/IPsec packet handling.
• Review recent logs and telemetry for unexplained memory pressure or denial-of-service symptoms on systems handling IPv6 XFRM/IPsec traffic.
• Track vendor advisories for exact fixed kernel versions because no fixed versions were provided in the supplied vulnerability metadata.