CVE-2026-64132 Overview
CVE-2026-64132 is a use-after-free vulnerability in the Linux kernel's IPv6 In-situ Operations, Administration, and Maintenance (IOAM) subsystem. The flaw resides in the ipv6_hop_ioam() function, where a stale pointer to the socket buffer's linear data region is dereferenced after skb_ensure_writable() may have reallocated the buffer. An attacker sending crafted IPv6 packets with IOAM hop-by-hop options can trigger memory corruption in kernel space.
Critical Impact
Remote attackers can trigger a kernel use-after-free by sending crafted IPv6 packets containing IOAM options, potentially leading to kernel memory corruption, denial of service, or arbitrary code execution in kernel context.
Affected Products
- Linux kernel versions containing the IPv6 IOAM hop-by-hop option handling in ipv6_hop_ioam()
- Distributions shipping vulnerable kernels prior to the referenced stable patches
- Systems with IPv6 IOAM processing enabled in the network stack
Discovery Timeline
- 2026-07-19 - CVE-2026-64132 published to the National Vulnerability Database (NVD)
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64132
Vulnerability Analysis
The vulnerability exists in ipv6_hop_ioam(), which processes IPv6 IOAM hop-by-hop extension header options. The function initializes a local hdr pointer that references the socket buffer's (skb) linear data region. It then invokes skb_ensure_writable() to guarantee the target range is writable before modifying it.
When the skb is cloned or lacks sufficient linear headroom, skb_ensure_writable() internally calls pskb_expand_head(). This routine allocates a new data buffer, copies packet contents, and frees the original buffer. Any previously cached pointers into the old buffer become dangling references.
The existing code recalculates the trace pointer after the call but neglects to refresh hdr. The stale hdr is later dereferenced when passing hdr->opt_len to ioam6_event(), resulting in a read from freed memory [CWE-416].
Root Cause
The root cause is failure to refresh a cached pointer following a potential buffer reallocation. Kernel networking code that holds pointers into skb linear data must reload those pointers after any operation that can invoke pskb_expand_head(). The upstream fix recalculates hdr from skb_network_header(skb) + optoff before calling ioam6_event().
Attack Vector
Exploitation requires the attacker to deliver IPv6 packets containing IOAM hop-by-hop options to a vulnerable host on a reachable network path. When the target skb is cloned or has insufficient linear headroom, the reallocation path triggers, and the subsequent read through the stale pointer occurs in kernel context. Successful exploitation can produce a kernel oops, denial of service, or leaking of adjacent freed memory contents depending on allocator state.
No verified public proof-of-concept code is available. See the upstream commits referenced under Kernel Git Commit 24de676d and Kernel Git Commit e46e6bc9 for the fix.
Detection Methods for CVE-2026-64132
Indicators of Compromise
- Unexpected kernel oops, panic, or KASAN reports referencing ipv6_hop_ioam or ioam6_event in dmesg and /var/log/kern.log
- Anomalous inbound IPv6 traffic carrying hop-by-hop extension headers with IOAM option type 49
- Repeated network interface resets or IPv6 stack instability correlated with specific remote sources
Detection Strategies
- Enable CONFIG_KASAN on test systems to surface use-after-free reads in the IPv6 IOAM path during fuzzing
- Deploy network intrusion detection signatures for IPv6 hop-by-hop extension headers containing IOAM option type identifiers
- Correlate kernel crash telemetry with IPv6 packet captures to identify malicious traffic patterns
Monitoring Recommendations
- Forward kernel crash logs and dmesg output to a centralized logging platform for anomaly review
- Monitor for unusual IPv6 extension header usage on ingress interfaces, particularly IOAM options from untrusted sources
- Track kernel version inventory to identify hosts still running unpatched builds
How to Mitigate CVE-2026-64132
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable tree commits and reboot affected systems
- Inventory all Linux hosts and containers running kernels with the IPv6 IOAM feature compiled in
- Prioritize patching internet-facing hosts and network appliances that process IPv6 traffic
Patch Information
The fix recalculates the hdr pointer after skb_ensure_writable() and before it is dereferenced by ioam6_event(). Patches are available in the upstream stable tree at Kernel Git Commit 24de676d, Kernel Git Commit 5af905aa, Kernel Git Commit 76972312, and Kernel Git Commit e46e6bc9. Consume the fix through your distribution's kernel security update channel.
Workarounds
- Drop IPv6 packets containing hop-by-hop IOAM options at network perimeter devices using ip6tables or nftables rules where IOAM is not required
- Disable IPv6 on hosts that do not require it if patching cannot be performed promptly
- Restrict IPv6 ingress to trusted peers on hosts running unpatched kernels
# Example ip6tables rule to drop IPv6 packets with hop-by-hop extension headers
# from untrusted interfaces (adjust interface name as needed)
ip6tables -A INPUT -i eth0 -m ipv6header --header hop-by-hop --soft -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
