CVE-2026-46120: Linux Kernel Use-After-Free Vulnerability

CVE-2026-46120 Overview

CVE-2026-46120 is a use-after-free vulnerability in the Linux kernel's IPv6 GRE tunnel driver (ip6_gre). The flaw resides in ip6erspan_changelink(), which uses dev_net(dev) instead of the cached t->net when re-inserting an ERSPAN tunnel into the per-netns hash table. After an IFLA_NET_NS_FD migration, the device's current netns diverges from its creation netns, causing the tunnel to be inserted into the wrong hash. The original netns retains a stale entry. When that netns is destroyed, ip6gre_exit_rtnl_net() walks the stale entry and triggers a slab-use-after-free followed by a kernel BUG in unregister_netdevice_many_notify(). The bug is reachable from an unprivileged user namespace.

Critical Impact
Unprivileged local users can trigger kernel memory corruption and a kernel panic via crafted network namespace operations.

Affected Products

Linux kernel versions containing commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops") prior to the fix
Linux distributions shipping the ip6_gre module with ERSPAN support
Systems where unprivileged user namespaces are enabled (default on most modern distributions)

Discovery Timeline

2026-05-28 - CVE-2026-46120 published to NVD
2026-05-28 - Last updated in NVD database

Technical Details for CVE-2026-46120

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the IPv6 GRE ERSPAN tunnel implementation. After commit 5e72ce3e3980, ip6erspan_newlink() correctly resolves the per-netns ip6gre hash using link_net. However, ip6erspan_changelink() was not updated in the same series and continues to call dev_net(dev) to locate the hash bucket.

When a userspace process migrates the tunnel device to a different network namespace via IFLA_NET_NS_FD, the value returned by dev_net(dev) changes. A subsequent changelink operation then re-inserts the tunnel into the hash table of the new netns while leaving a dangling reference in the original netns hash.

When the original netns is destroyed, ip6gre_exit_rtnl_net() iterates the stale hash entry. KASAN reports a slab-use-after-free, followed by a kernel BUG at net/core/dev.c when unregister_netdevice_many_notify() encounters a LIST_POISON1 value.

Root Cause

The root cause is inconsistent netns resolution between ip6erspan_newlink() and ip6erspan_changelink(). The newlink path uses the cached link_net, while changelink relies on the device's current netns via dev_net(dev). The sibling function ip6gre_changelink() already uses the cached t->net correctly. Only ip6erspan_changelink() retained the buggy pattern.

Attack Vector

An unprivileged local attacker can trigger the flaw by entering a user namespace with unshare --user --map-root-user --net, creating an ip6erspan tunnel, migrating it to another netns through IFLA_NET_NS_FD, invoking a changelink operation, and then destroying the original netns. The resulting use-after-free can cause kernel panic and may enable further memory corruption primitives depending on slab layout.

The vulnerability is described in the upstream patch series. See the Kernel Commit 1d324c2 and related stable backports for the implementation fix.

Detection Methods for CVE-2026-46120

Indicators of Compromise

KASAN reports referencing slab-use-after-free in ip6gre_exit_rtnl_net or ip6erspan_changelink
Kernel BUG messages at net/core/dev.c with LIST_POISON1 in unregister_netdevice_many_notify()
Unexpected kernel panics following network namespace teardown on hosts using GRE/ERSPAN tunnels

Detection Strategies

Audit kernel ring buffer (dmesg) and journald logs for KASAN splats referencing ip6_gre or ip6erspan symbols
Monitor for unshare invocations combined with ip link add type ip6erspan and subsequent ip link set ... netns operations from unprivileged users
Track IFLA_NET_NS_FD netlink attribute usage on ERSPAN tunnel devices through eBPF or auditd rules

Monitoring Recommendations

Enable kernel crash collection (kdump, pstore) on production Linux hosts to capture forensic evidence of exploitation attempts
Alert on repeated unprivileged user namespace creation paired with netlink tunnel manipulation
Forward kernel logs to a centralized SIEM and trigger alerts on KASAN, BUG:, and general protection fault strings tied to networking subsystems

How to Mitigate CVE-2026-46120

Immediate Actions Required

Apply the upstream kernel patches that switch ip6erspan_changelink() to use the cached t->net reference
Update to a distribution kernel that incorporates the stable backports referenced in the NVD entry
Restrict unprivileged user namespace creation where operationally feasible by setting kernel.unprivileged_userns_clone=0 or user.max_user_namespaces=0

Patch Information

Fixes are available in upstream Linux stable trees. Relevant commits include Kernel Commit 1d324c2, Kernel Commit 311fdd26, Kernel Commit cf7fc624, Kernel Commit e70cfb40, and Kernel Commit eca62bb0. The patch replaces dev_net(dev) with the cached t->net so that the per-netns hash lookup matches the tunnel's creation namespace.

Workarounds

Disable unprivileged user namespaces via sysctl -w kernel.unprivileged_userns_clone=0 on Debian/Ubuntu derivatives
Blacklist the ip6_gre module on systems that do not require IPv6 GRE or ERSPAN tunneling
Apply seccomp or AppArmor profiles to restrict unshare, setns, and netlink tunnel configuration syscalls for untrusted workloads

bash

# Configuration example
# Disable unprivileged user namespaces
sysctl -w kernel.unprivileged_userns_clone=0
echo 'kernel.unprivileged_userns_clone=0' >> /etc/sysctl.d/99-harden.conf

# Blacklist ip6_gre if unused
echo 'blacklist ip6_gre' > /etc/modprobe.d/blacklist-ip6gre.conf