CVE-2026-80792: Linux Kernel IPv6 Use-After-Free Vulnerability

CVE-2026-80792 Overview

CVE-2026-80792 is a use-after-free vulnerability in the Linux kernel's IPv6 output path. The flaw resides in ip6_finish_output2(), which caches a pointer to the IPv6 destination address (daddr) before calling lwtunnel_xmit(). Encapsulation operations inside lwtunnel_xmit(), including the Lightweight Tunnel BPF (LWT-BPF) transmit path, can reallocate the socket buffer (skb) head and free the memory backing daddr. When the function continues with LWTUNNEL_XMIT_CONTINUE, subsequent nexthop computation and neighbour lookup dereference the freed pointer. The Linux kernel maintainers resolved the issue by re-fetching the IPv6 header and destination address pointer after lwtunnel_xmit() returns.

Critical Impact
Exploitation can leak sensitive kernel memory, corrupt the neighbour table with attacker-influenced values, misdirect network traffic, or crash the affected system.

Affected Products

Linux kernel versions containing the vulnerable ip6_finish_output2() code path with LWT-BPF or lwtunnel encapsulation support
Linux distributions shipping kernels prior to the stable backport commits referenced in the kernel.org advisory
Systems using IPv6 with lightweight tunnel encapsulation (LWT-BPF, seg6, ILA) enabled

Discovery Timeline

2026-09-04 - CVE-2026-80792 published to NVD
2026-09-04 - Last updated in NVD database

Technical Details for CVE-2026-80792

Vulnerability Analysis

The vulnerability is a use-after-free read [CWE-416] in the IPv6 transmit path of the Linux kernel networking stack. ip6_finish_output2() prepares packets for link-layer transmission by resolving the next hop and neighbour entry using the IPv6 destination address stored in the packet's header. To avoid repeated header lookups, the function caches a daddr pointer referencing memory inside the skb head.

Before transmitting, the function may invoke lwtunnel_xmit() to perform encapsulation. Certain lwtunnel implementations, particularly LWT-BPF programs, can call skb_cow_head() or otherwise reallocate the skb head buffer. This reallocation frees the original memory region that the cached daddr pointer references.

When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, execution falls through to the nexthop resolution and neighbour lookup logic. Those operations dereference the now-dangling daddr pointer, reading freed slab memory.

Root Cause

The root cause is a stale pointer retained across a function call that can invalidate its backing memory. The ip6_finish_output2() function did not re-derive the destination address after control returned from lwtunnel_xmit(), violating the invariant that pointers into skb->data become invalid after any head reallocation.

Attack Vector

A local attacker with the ability to load or attach LWT-BPF programs, or to install lwtunnel routes that reallocate the skb head, can trigger the free during IPv6 transmission. The subsequent read of freed memory can disclose adjacent slab contents into neighbour table entries, poisoning ARP-equivalent state, redirecting traffic, or corrupting kernel structures to cause a denial of service. On systems that expose lwtunnel functionality broadly, remote packet flows traversing a misconfigured tunnel may also trigger the condition.

No public proof-of-concept exploit code has been published for this issue. Refer to the kernel.org stable commits for the authoritative patch diff.

Detection Methods for CVE-2026-80792

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ip6_finish_output2, ip6_output, or neigh_resolve_output in dmesg and /var/log/kern.log
KASAN reports flagging use-after-free reads in the IPv6 output path when kernel address sanitizer is enabled
Neighbour table entries (ip -6 neigh show) containing anomalous or non-deterministic hardware addresses on hosts using lwtunnel encapsulation
Unexplained IPv6 packet misdelivery or MAC address flapping on interfaces attached to LWT-BPF routes

Detection Strategies

Enable KASAN in test environments to surface the use-after-free deterministically during IPv6 traffic with lwtunnel encapsulation
Audit installed routes for lwtunnel encapsulation types using ip -6 route show and flag any BPF-attached routes on unpatched hosts
Correlate kernel crash telemetry across the fleet to identify repeated faults in the IPv6 output path

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized logging platform and alert on stack traces containing ip6_finish_output2
Monitor auditd for bpf() syscalls attaching BPF programs of type BPF_PROG_TYPE_LWT_XMIT
Track kernel package versions across Linux fleets and alert when hosts run kernels lacking the referenced stable backports

How to Mitigate CVE-2026-80792

Immediate Actions Required

Inventory Linux hosts and identify kernels that do not include the fix commits (3dc98e5f, 087ee0d9, 73a18738, d0d48d99, 75e0a544, 99219c82, c95f01b7, d960881b, 3c770ac4)
Apply vendor-supplied kernel updates from your Linux distribution as soon as they become available
Restrict CAP_NET_ADMIN and CAP_BPF to trusted administrators to limit who can attach LWT-BPF programs
Reboot systems after kernel package installation to load the patched image

Patch Information

The upstream fix re-fetches the IPv6 header and destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring nexthop and neighbour operations use valid memory. The patch has been backported to multiple stable branches. Reference commits include 087ee0d9, 3dc98e5f, 73a18738, 75e0a544, 99219c82, c95f01b7, d0d48d99, d960881b, and 3c770ac4.

Workarounds

Remove or avoid lwtunnel encapsulation routes on hosts that cannot be immediately patched, particularly routes using BPF encapsulation
Disable IPv6 on interfaces where it is not required by setting net.ipv6.conf.all.disable_ipv6=1 via sysctl
Restrict unprivileged BPF by setting kernel.unprivileged_bpf_disabled=1 to prevent non-root users from loading BPF programs

bash

# Configuration example
sudo sysctl -w kernel.unprivileged_bpf_disabled=1
sudo sysctl -w net.ipv6.conf.all.disable_ipv6=1
# Persist across reboots
echo 'kernel.unprivileged_bpf_disabled=1' | sudo tee /etc/sysctl.d/90-cve-2026-80792.conf
# Verify installed kernel version
uname -r