CVE-2026-80792 ipv6: fix use-after-free in ip6_finish_output2()
A use-after-free in the Linux kernel IPv6 stack allows attackers to leak sensitive data, corrupt neighbor tables, or crash the system via crafted network traffic.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-80792?
CVE-2026-80792 is an use after free vulnerability in Linux, published on 4 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix use-after-free in ip6_finish_output2()
ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system.
Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.
Which versions are affected by CVE-2026-80792?
How do I fix CVE-2026-80792?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-80792 being exploited?
There is no known exploitation of CVE-2026-80792 in the wild and no public exploit code.
Sources
Also known as AZL-99428, BELL-CVE-2026-80792, DEBIAN-CVE-2026-80792, GHSA-4jhv-hqg8-9j35, UBUNTU-CVE-2026-80792.