CVE-2026-68127: Linux Kernel Use-After-Free Vulnerability

CVE-2026-68127 Overview

CVE-2026-68127 is a use-after-free vulnerability in the Linux kernel's Identifier-Locator Addressing (ILA) subsystem. The flaw resides in ila_csum_adjust_transport(), which caches the IPv6 header pointer (ip6h = ipv6_hdr(skb)) before calling pskb_may_pull(). On non-linear socket buffers, pskb_may_pull() may invoke __pskb_pull_tail() or pskb_expand_head() and free the original skb head, leaving the cached pointer dangling. Subsequent reads in get_csum_diff() and writes in ila_update_ipv6_locator() access freed slab memory. A remote IPv6 packet traversing a configured ILA route or receive-side mapping triggers the condition, detectable by KASAN as a slab-use-after-free.

Critical Impact
Unauthenticated remote IPv6 packets can trigger a slab use-after-free in kernel context on hosts with an ILA csum-adjust-transport route or mapping configured, enabling potential memory corruption and code execution.

Affected Products

Linux kernel builds shipping the ILA (Identifier-Locator Addressing) module with ila_csum_adjust_transport() prior to the fixes referenced in kernel.org commits 472aba2, 7097a02, 896a951, 92d3817, and c6a13ae
Distributions that expose ILA and permit CAP_NET_ADMIN administrators to install ILA routes or receive-side mappings
IPv6-enabled Linux hosts acting as routers or endpoints with ILA translation configured

Discovery Timeline

2026-08-10 - CVE-2026-68127 published to the National Vulnerability Database
2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-68127

Vulnerability Analysis

The ILA module implements IPv6 identifier-locator translation and adjusts transport-layer checksums when the locator portion of the destination address is rewritten. ila_csum_adjust_transport() reads ip6h = ipv6_hdr(skb) once at entry and reuses that pointer after calling pskb_may_pull() to ensure the transport header is linear.

When the skb is non-linear and the transport header sits in a page fragment, pskb_may_pull() may reallocate the skb head through __pskb_pull_tail() or pskb_expand_head(). The original skb head is freed to the slab allocator, but the cached ip6h still references the freed region. The following get_csum_diff(ip6h, p) call then reads freed memory.

The defect propagates further. ila_update_ipv6_locator() reuses ip6h and an iaddr value derived from it after the checksum-adjust call, and it writes the new locator through the dangling pointer. This converts a stale read into a stale write against slab memory that may already be reallocated to another object.

Root Cause

The root cause is a failure to reload a cached header pointer after an operation that can reallocate the socket buffer head. Kernel networking code must treat any pointer derived from skb->data as invalidated after pskb_may_pull(), skb_cow(), or similar routines that may call pskb_expand_head(). This is a classic use-after-free pattern in packet-processing paths.

Attack Vector

Configuration of an ILA csum-adjust-transport route or receive-side mapping requires CAP_NET_ADMIN. Once installed, however, no authentication is needed to trigger the bug. Any remote IPv6 packet routed through the affected translation with a non-linear skb layout reaches the vulnerable code path. Attackers can craft fragmented IPv6 traffic or leverage large packets that land with transport headers in page fragments to force the reallocation path.

The vulnerability description does not reference public exploit code. See the upstream fixes at the Linux kernel git tree for the reload logic added to both ila_csum_adjust_transport() and ila_update_ipv6_locator().

Detection Methods for CVE-2026-68127

Indicators of Compromise

KASAN reports flagging slab-use-after-free in ila_update_ipv6_locator or ila_csum_adjust_transport in kernel logs
Kernel oops, general protection fault, or panic traces referencing the ila module during IPv6 packet processing
Unexpected corruption of neighboring slab objects on hosts with ILA routes installed under ip ila list

Detection Strategies

Inventory kernel versions across Linux fleets and correlate against the fixed commits 472aba2, 7097a02, 896a951, 92d3817, and c6a13ae
Enumerate hosts where the ila module is loaded (lsmod | grep ila) and where ILA routes or mappings exist
Enable KASAN in test and canary builds to surface latent use-after-free triggers during IPv6 fuzzing

Monitoring Recommendations

Alert on kernel ring buffer entries containing BUG: KASAN, use-after-free, or oops traces referencing ila_* symbols
Monitor administrative changes to ILA configuration via iproute2 audit logs on hosts with CAP_NET_ADMIN delegation
Track IPv6 traffic patterns on ILA translation nodes for fragmented or unusually large packets that force non-linear skb paths

How to Mitigate CVE-2026-68127

Immediate Actions Required

Apply the upstream kernel patches referenced by commits 472aba2, 7097a02, 896a951, 92d3817, and c6a13ae from your distribution's stable kernel updates
On hosts that do not require ILA, unload the ila module and blacklist it to eliminate the attack surface entirely
Restrict CAP_NET_ADMIN on shared or multi-tenant hosts to prevent unnecessary ILA route installation

Patch Information

Upstream fixes reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the checksum-diff read. In ila_update_ipv6_locator(), only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so ip6h and iaddr are reloaded in that branch alone before the destination-address write. Neutral-map modes never pull and continue to use cached pointers safely. See the Linux kernel stable commit 7097a02 and the companion fix commit 896a951.

Workarounds

Remove ILA routes and receive-side mappings from production hosts until patches are deployed using ip ila del for each installed entry
Prevent the ila kernel module from loading with install ila /bin/true in a /etc/modprobe.d/ configuration file on systems that do not use identifier-locator addressing
Filter fragmented IPv6 traffic at upstream network devices where operationally feasible to reduce non-linear skb triggers reaching ILA nodes

bash

# Disable and blacklist the ILA module on hosts that do not require it
sudo rmmod ila 2>/dev/null
echo 'install ila /bin/true' | sudo tee /etc/modprobe.d/blacklist-ila.conf
sudo update-initramfs -u

# Verify no ILA routes remain configured
ip ila list