HIGH Introduced in 3.13
ipv6 Fib6Walker UAF
CVE-2026-97940
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
KernelScan AI7.7HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race.
02KernelScan AI Analysis
Risk summary
A local unprivileged user can exploit a race in the IPv6 routing table iterator to trigger a use-after-free in kernel memory. The bug is reachable via reading /proc/net/ipv6_route or a BPF ipv6_route iterator while route deletion occurs concurrently. On systems with IPv6 enabled and user namespaces available, this can lead to kernel code execution and container escape.
Vulnerability analysis
The IPv6 routing table iterator keeps a walker object linked on a per-network-namespace list while a process reads the routing table through /proc/net/ipv6_route or a BPF iterator. A race with concurrent route deletion can put a still-linked walker into a state that the cleanup path mistakes for already unlinked, so the walker's owning object is freed without being removed from the list. A subsequent route deletion traverses the stale list entry and dereferences the freed memory. The fix replaces the state-based heuristic with a direct list-membership check so the walker is always properly unlinked before its memory is released. An unprivileged local user can trigger the read side of the race; the route-deletion side needs capabilities obtainable through user namespaces, making this reachable without elevated host privileges on systems with IPv6 enabled.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.10 | 3.13 | 5.10.271 | 9a3f73d62c86 |
| 5.15 | 3.13 | 5.15.222 | 63407cddabc5 |
| 6.1 | 3.13 | 6.1.189 | 05b687ee04f8 |
| 6.6 | 3.13 | 6.6.158 | 14fdaba201fd |
| 6.12 | 3.13 | 6.12.111 | 0eede1689610 |
| 6.18 | 3.13 | 6.18.53 | b89b691dd00b |
| 7.2 | 3.13 | 7.2.7 | 4553cfafa8d0 |
| mainline | 3.13 | 7.3-rc3 | 19b4ed644d68 |
| cip/6.12 | 3.13 | 6.12.111-cip32 | 0eede1689610 |