Cloudanix VulnDB

CVE-2026-89563

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Sep 11, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel handles certain IPv6 network tunnels can let a logged-in user crash the system or potentially take control of it.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in ip6_tnl_xmit() caused by skb_realloc_headroom() replacing the skb while error paths in collect_md tunnels and ip6_tnl_encap() still reference the original pointer, allowing double-free or memory corruption on failure returns from ip6_tnl_start_xmit() and IPv6 GRE paths.

Why it matters to the business

Local attackers on affected systems can trigger kernel crashes, memory corruption, or potential privilege escalation, leading to denial of service, loss of system availability, or compromise of the host.

How an attack unfolds

An attacker with local access crafts network traffic or configures IPv6 tunnel interfaces to force ip6_tnl_xmit() into post-reallocation error paths; the caller then frees an already-consumed skb, resulting in use-after-free that can be leveraged for corruption or code execution.

How to fix it

Apply the upstream fix that replaces skb_realloc_headroom() with skb_cow_head() in ip6_tnl_xmit(); rebuild and deploy updated kernels across all affected systems; verify that ip6gretap and ip6erspan paths continue to use skb_cow_head() before entry.

How to confirm the fix worked

Confirm the kernel source contains the skb_cow_head() change in ip6_tnl_xmit(); test error paths with collect_md tunnels and encap failures to ensure no stale skb references remain; run regression tests on IPv6 GRE and tunnel transmit paths.

Typical attack path

  1. Obtain local user access on a Linux system using IPv6 tunnels (ip6gre, ip6gretap, ip6erspan, or collect_md).
  2. Configure or trigger tunnel transmission paths that invoke ip6_tnl_xmit().
  3. Force an error after skb_realloc_headroom() (e.g., non-NONE encap rejection or ip6_tnl_encap() failure).
  4. Trigger the caller to free the stale original skb pointer, causing use-after-free.
  5. Leverage the resulting memory corruption for privilege escalation or denial of service.

How to detect it

Search kernel logs for oops/panic traces mentioning ip6_tnl_xmit, skb_realloc_headroom, or double-free patterns in IPv6 tunnel transmit paths; examine audit logs for unusual tunnel interface creation or traffic from low-privileged users; review crash dumps for skb ownership anomalies.

  • ip6_tnl_xmit
  • skb_realloc_headroom
  • ip6_tnl_start_xmit
  • collect_md tunnel encap error

What your security team should do

  • Prioritize kernel upgrades on all systems exposing IPv6 tunnel interfaces, especially those reachable by untrusted local users.
  • Monitor for kernel oops or panic reports involving ip6_tnl_xmit or skb handling.
  • Restrict local access and tunnel configuration privileges until patches are applied.
  • Audit downstream kernel packages and distributions for inclusion of the fix.

The record

In the Linux kernel, the following vulnerability has been resolved: ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit() ip6_tnl_xmit() may need to expand headroom before it can push the outer IPv6 and optional encap headers. It currently does that with skb_realloc_headroom(), copies skb->sk ownership, consumes the original skb, and then continues processing with the replacement skb kept only in its local variable. That is safe only if the helper cannot fail afterwards. But this helper still has post-reallocation error exits. collect_md tunnels reject non-NONE encap after the replacement, and ip6_tnl_encap() can also fail later. In those cases the helper returns an error to its callers while the caller still only has the original skb pointer. Both ip6_tnl_start_xmit() and the IPv6 GRE paths free the caller skb on error, so they can end up freeing an skb that ip6_tnl_xmit() already consumed. Use skb_cow_head() instead. It provides the required headroom and writability without privately replacing the caller-owned skb, so later error returns cannot leave callers with a stale pointer. The Ethernet users, ip6gretap and ip6erspan, clear IFF_TX_SKB_SHARING and already call skb_cow_head() before entering ip6_tnl_xmit(). They do not rely on the removed skb_shared() reallocation. This also makes the IPv6 tunnel path consistent with ip_tunnel_xmit().

Affected packages

Ecosystem Package Introduced Fixed