CVE-2026-89563: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89563 Overview

CVE-2026-89563 is a Linux kernel vulnerability in the IPv6 tunnel transmit path (ip6_tnl_xmit()). The function used skb_realloc_headroom() to expand headroom before pushing outer IPv6 and optional encapsulation headers. On post-reallocation error paths, the helper consumed the original socket buffer (skb) but returned an error to callers that still held the original skb pointer. Callers such as ip6_tnl_start_xmit() and the IPv6 GRE paths then freed the already-consumed skb, producing a use-after-free or double-free condition in kernel network memory.

Critical Impact
A local attacker with network transmit capability through an IPv6 tunnel can trigger memory corruption in the kernel, potentially leading to privilege escalation or denial of service.

Affected Products

Linux kernel IPv6 tunnel subsystem (ip6_tunnel)
IPv6 GRE tunnel driver (ip6_gre, including ip6gretap and ip6erspan)
Distributions shipping affected kernel versions prior to the referenced stable commits

Discovery Timeline

2026-09-11 - CVE-2026-89563 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89563

Vulnerability Analysis

The vulnerability is a Use-After-Free (UAF) in the Linux kernel IPv6 tunnel transmit function. ip6_tnl_xmit() must guarantee enough headroom in the socket buffer to prepend an outer IPv6 header and optional encapsulation headers before transmitting.

The original implementation called skb_realloc_headroom(), which allocates a replacement skb, copies socket ownership, and consumes the original. The replacement was only tracked in a local variable inside the helper. This pattern is safe only if the function cannot fail afterward.

However, the helper contained further error-exit paths. collect_md tunnels reject non-NONE encapsulation after the replacement is made, and ip6_tnl_encap() itself can also fail. When these later failures returned an error, callers still referenced the original, already-freed skb.

Root Cause

The root cause is a violation of skb ownership contract. skb_realloc_headroom() transfers ownership to the helper's local pointer while leaving the caller with a stale reference. Callers including ip6_tnl_start_xmit() and the IPv6 GRE transmit paths free the caller-owned skb on error, resulting in a double-free or use-after-free of the buffer that the helper already consumed.

Attack Vector

Exploitation requires local access with permission to send traffic through an IPv6 tunnel interface (ip6tnl, ip6gre, ip6gretap, or ip6erspan). An attacker crafts packets or tunnel configurations that trigger the post-reallocation error paths, such as invalid encapsulation state on collect_md tunnels or forcing ip6_tnl_encap() failure. The resulting freed-buffer condition can corrupt kernel slab memory used by other allocations, enabling potential privilege escalation or system crash.

The fix replaces skb_realloc_headroom() with skb_cow_head(), which provides the required headroom and writability without privately replacing the caller-owned skb. This makes the IPv6 tunnel path consistent with ip_tunnel_xmit().

Detection Methods for CVE-2026-89563

Indicators of Compromise

Unexpected kernel oops or panic messages referencing ip6_tnl_xmit, ip6gre_tunnel_xmit, or skb_release_* functions
KASAN reports flagging use-after-free in the IPv6 tunnel transmit path
Sudden network interface stalls on ip6tnl, ip6gre, ip6gretap, or ip6erspan devices under encapsulation error conditions

Detection Strategies

Enable Kernel Address Sanitizer (KASAN) on test kernels to identify UAF conditions in the tunnel path
Monitor dmesg and journalctl -k for stack traces containing ip6_tnl_xmit or skb_release_data after tunnel errors
Audit running kernel version against fixed stable commits referenced in the kernel.org stable tree

Monitoring Recommendations

Collect kernel crash dumps and forward them to a centralized log platform for triage
Alert on repeated network interface resets on IPv6 tunnel devices
Track kernel package versions across the fleet and flag hosts running unpatched builds

How to Mitigate CVE-2026-89563

Immediate Actions Required

Apply the Linux kernel stable updates that replace skb_realloc_headroom() with skb_cow_head() in ip6_tnl_xmit()
Inventory hosts running IPv6 tunnel interfaces (ip6tnl, ip6gre, ip6gretap, ip6erspan) and prioritize them for patching
Restrict CAP_NET_ADMIN and unprivileged user namespace tunnel creation where feasible

Patch Information

The upstream fix is distributed across multiple stable kernel branches. See the following commits: 37df5bc6b5cc, 629d5557e635, 6e8eff8ed13b, 87f21b59ddc6, 8fc56ca49fc0, b36dfd6e8cff, dc1a319a4815, and defa0adeff13. Consult your distribution vendor for backported packages.

Workarounds

Disable or remove unused IPv6 tunnel modules by blocklisting ip6_tunnel and ip6_gre where tunneling is not required
Prevent unprivileged users from creating network namespaces by setting user.max_user_namespaces=0 on hosts that do not need them
Remove CAP_NET_ADMIN from workloads that do not require tunnel management

bash

# Blocklist unused IPv6 tunnel modules
echo 'blacklist ip6_tunnel' | sudo tee /etc/modprobe.d/blacklist-ip6tnl.conf
echo 'blacklist ip6_gre'    | sudo tee -a /etc/modprobe.d/blacklist-ip6tnl.conf

# Restrict unprivileged user namespaces (limits attacker access to tunnel APIs)
echo 'user.max_user_namespaces=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system

# Verify kernel version after patching
uname -r