Cloudanix VulnDB

CVE-2026-89555

Critical · 9.8

CVSS

9.8

EPSS

0.7%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in how the Linux kernel handles certain network packets can let an attacker crash the system or take control of it by sending specially formed traffic.

Exploitation
Remote Unauthenticated
Attacker needs
None
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in mpls_select_multipath when pskb_may_pull triggers pskb_expand_head, invalidating a cached hdr pointer that is later dereferenced while walking an MPLS label stack or reading inner IPv4/IPv6 headers.

Why it matters to the business

Kernel memory corruption on network devices handling MPLS multipath routes can cause crashes or remote code execution, disrupting packet forwarding and exposing the system to full compromise.

How an attack unfolds

An attacker sends a specially constructed packet (such as a Geneve-encapsulated frame) that arrives via a bareudp interface and traverses an MPLS multipath route; the multipath hash routine caches a header pointer, pskb_may_pull reallocates the skb head, and subsequent reads use the now-freed memory, triggering the flaw.

How to fix it

Apply the upstream kernel commit that reloads the hdr pointer from the current skb head after every successful pskb_may_pull before deriving inner header pointers; rebuild and deploy the patched kernel on all affected systems.

How to confirm the fix worked

Verify the presence of the reload-after-pull change in the mpls_multipath_hash function; run the static-analysis reproducer or a legal Geneve-over-MPLS multipath test and confirm absence of KASAN slab-use-after-free reports.

Typical attack path

  1. Craft packet that reaches an MPLS multipath route with nonlinear inner headers
  2. Trigger mpls_multipath_hash via mpls_select_multipath during GRO or receive processing
  3. Force pskb_may_pull to call pskb_expand_head, freeing the original skb head
  4. Continue execution that dereferences the stale hdr pointer for IPv4 or IPv6 header data

How to detect it

Inspect kernel logs for KASAN slab-use-after-free reports citing mpls_select_multipath, mpls_forward, or pskb_expand_head; correlate with network receive paths involving bareudp or MPLS multipath.

  • BUG: KASAN: slab-use-after-free in mpls_select_multipath
  • Read of size 1 at addr
  • mpls_select_multipath -> mpls_forward -> __netif_receive_skb_list_core
  • Freed by task: kfree pskb_expand_head __pskb_pull_tail mpls_select_multipath

What your security team should do

  • Prioritize kernel upgrade on all MPLS-enabled routers and hosts within the next maintenance window
  • Restrict exposure of MPLS interfaces to trusted traffic until patches are applied
  • Enable KASAN or similar memory-safety instrumentation in test environments to validate the fix

The record

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear data and insufficient tailroom in the linear head, pskb_may_pull() calls pskb_expand_head() to replace the skb head and free the old one. This leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr again when it performs a second pull for the larger header. The issue was found through static analysis. A reproducer sending a legal Geneve packet through a bareudp/MPLS multipath setup triggered the same KASAN report in 2 of 2 unpatched runs: BUG: KASAN: slab-use-after-free in mpls_select_multipath Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23 Call Trace: mpls_select_multipath mpls_forward __netif_receive_skb_list_core netif_receive_skb_list_internal napi_complete_done gro_cell_poll __napi_poll net_rx_action Freed by task 23: kfree pskb_expand_head __pskb_pull_tail mpls_select_multipath Reload hdr from the current skb head after each successful pull before deriving the inner IPv4 or IPv6 header pointer.

Affected packages

Ecosystem Package Introduced Fixed