CVE-2026-53006: Linux Kernel Use-After-Free Vulnerability

CVE-2026-53006 Overview

CVE-2026-53006 is a use-after-free (UAF) vulnerability in the Linux kernel IPv6 stack, specifically within the icmpv6_rcv() function. The flaw stems from caching the source and destination IPv6 addresses (saddr and daddr) in local variables before calling pskb_pull(). Because pskb_pull() can reallocate skb->head, the cached pointers may reference freed memory. Subsequent dereference of these stale pointers in the slow path through net_dbg_ratelimited() can lead to memory corruption or information disclosure. The kernel maintainers resolved the issue by removing the temporary variables and accessing the IPv6 header fields directly when needed.

Critical Impact
Triggering the slow path in icmpv6_rcv() after pskb_pull() reallocates the socket buffer can result in a use-after-free read of stale IPv6 header pointers, potentially leading to kernel memory disclosure or system instability.

Affected Products

Linux kernel (IPv6 networking subsystem, net/ipv6/icmp.c)
Multiple stable kernel branches receiving backports across the listed patch commits
Distributions shipping vulnerable kernel versions prior to applying upstream fixes

Discovery Timeline

2026-06-24 - CVE-2026-53006 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53006

Vulnerability Analysis

The vulnerability resides in the IPv6 ICMP receive handler icmpv6_rcv() inside net/ipv6/icmp.c. The function previously stored pointers to the source and destination addresses from the IPv6 header before invoking pskb_pull(). pskb_pull() may trigger reallocation of skb->head, which moves the underlying packet buffer to a new memory location. Any pointer derived from the original ipv6_hdr(skb) becomes stale at that point.

The stale pointers were only dereferenced on the slow path, when net_dbg_ratelimited() logged debug information about malformed or unexpected ICMPv6 packets. An attacker capable of sending crafted ICMPv6 traffic that forces the slow path and causes pskb_pull() to reallocate the buffer can trigger a use-after-free read of freed kernel memory.

Root Cause

The root cause is improper lifetime management of pointers into skb->head across a function call that can reallocate that buffer. Caching &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr before pskb_pull() violates the assumption that header pointers must be re-derived after any operation that can mutate the socket buffer layout [CWE-416].

Attack Vector

The vulnerability is reachable through the IPv6 network path. An attacker on a network segment that can deliver IPv6 ICMP packets to a vulnerable host can craft traffic that forces the icmpv6_rcv() slow path and triggers pskb_pull() reallocation. Because the dangerous code only executes under rate-limited debug logging, exploitation is constrained by the conditions under which net_dbg_ratelimited() fires. The fix removes the temporary variables entirely and references &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr directly inside the debug call, eliminating the window where stale pointers could be used.

No public proof-of-concept exploit code is available for this issue. See the upstream patches such as Kernel Patch 0069813e and Kernel Patch f996edd for the exact source changes.

Detection Methods for CVE-2026-53006

Indicators of Compromise

Unexpected kernel oops, panics, or KASAN reports referencing icmpv6_rcv and pskb_pull in the call stack.
Kernel log entries from net_dbg_ratelimited() correlated with bursts of malformed ICMPv6 packets from unusual sources.
Sudden increases in inbound ICMPv6 traffic with header anomalies that force slow-path handling.

Detection Strategies

Enable KASAN on test or canary kernels to surface use-after-free reads in the IPv6 receive path during fuzzing or production replay.
Monitor kernel ring buffer (dmesg) and syslog for icmpv6 debug messages combined with memory corruption indicators.
Compare running kernel versions against vendor advisories listing the backported patch commits referenced above.

Monitoring Recommendations

Collect kernel crash dumps and dmesg output centrally and alert on stack traces containing icmpv6_rcv.
Apply network-layer telemetry to flag ICMPv6 floods or malformed packets targeting hosts not patched against this CVE.
Track patch compliance for the Linux kernel across the fleet, prioritizing internet-exposed and IPv6-enabled hosts.

How to Mitigate CVE-2026-53006

Immediate Actions Required

Inventory all Linux systems with IPv6 enabled and identify kernels predating the upstream fix.
Apply the distribution kernel update that incorporates the upstream patches as soon as vendor builds are available.
Restrict untrusted ICMPv6 traffic at network boundaries while patching is in progress.

Patch Information

The fix removes the cached saddr and daddr local variables in icmpv6_rcv() and accesses &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr directly only inside the net_dbg_ratelimited() slow path. The change has been backported to multiple stable trees. See the relevant commits: Kernel Patch 0069813e, Kernel Patch 085e31a, Kernel Patch 1e1f0f8, Kernel Patch 38bdbc8, Kernel Patch 7bff2c8, Kernel Patch 7c66b36, Kernel Patch aff0f28, and Kernel Patch f996edd.

Workarounds

Disable IPv6 on hosts where it is not required, using sysctl settings such as net.ipv6.conf.all.disable_ipv6=1.
Filter or rate-limit inbound ICMPv6 at perimeter firewalls and host firewalls (ip6tables/nftables) to reduce exposure.
Avoid running kernels with verbose IPv6 debug logging enabled on untrusted networks until patches are applied.

bash

# Configuration example: rate-limit inbound ICMPv6 with nftables
nft add table inet filter
nft add chain inet filter input { type filter hook input priority 0 \; }
nft add rule inet filter input meta l4proto ipv6-icmp limit rate 20/second accept
nft add rule inet filter input meta l4proto ipv6-icmp drop

# Verify kernel version against fixed builds
uname -r