Skip to content
CVSS 9.8 · CRITICAL

CVE-2026-53006

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. - Avoid potential future misuse after pskb_pull() call.

View on NVD

Analysis

A critical vulnerability in the Linux kernel networking stack (IPv6) allows for a Use-After-Free condition via crafted ICMPv6 packets. This could lead to remote code execution or system crashes on any internet-facing Linux server with IPv6 enabled.

Relevant roles

LinuxCyberSecurityBackendDockerKubernetesC

Severity

Score: 9.8(CRITICAL)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AV: NETWORK
AC: LOW
PR: NONE
UI: NONE
S: UNCHANGED
C: HIGH
I: HIGH
A: HIGH

EPSS

Probability of exploitation (next 30 days): 0.0018 (0.2%)
Percentile: 8.2%
EPSS: 2026-06-27

Technical description

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change. Remove these temporary variables: - We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr when net_dbg_ratelimited() is called in the slow path. - Avoid potential future misuse after pskb_pull() call.

Published: 6/24/2026, 5:17:11 PM
Last modified: 6/28/2026, 8:16:29 AM

References

HomeEventsBlogResourcesTeam