CVE-2026-80792

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-80792
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80792.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-80792
Downstream
AZL (1)
BELL (1)
DEBIAN (1)
MGASA (1)
openSUSE (1)
RHSA (4)
UBUNTU (1)
Related
Published
2026-09-04T15:13:04Z
Modified
2026-10-13T11:42:11Z
Summary
ipv6: fix use-after-free in ip6_finish_output2()
Details

In the Linux kernel, the following vulnerability has been resolved:

ipv6: fix use-after-free in ip6_finish_output2()

ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system.

Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.

Database specific 
{
    "cna_assigner":  "Linux",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/80xxx/CVE-2026-80792.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
4132c4ad00ddbf3a175ea0d2c775b662a32f4c85
Fixed
75e0a544ebe9af663ef53ca21e9e9185c51fb54a
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2
Fixed
c95f01b78266828a57060d754fcbfc92123a98ed
Fixed
d960881b9312e781a3429aabceb223ce6b7c882f
Fixed
087ee0d914aaae929f1660c9ca878e367655ba1a
Fixed
3c770ac4e6f07af7c7b40c474a3efc61ffed7862
Fixed
3dc98e5fe82d069dd29b124ffbdb679331dfea43
Fixed
99219c82804f266189388e8bf1cf5135d10d5515
Fixed
73a187384a8c8b983c7fea046d716b6752a1e7a3
Fixed
d0d48d999b0eee6bb176ef4e39d9be868fa80f7e
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.10.233
Fixed
5.10.267
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
5.4.289
Fixed
5.5
Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
1598154fd28ffa4a55beae1970475fd6776554b6

Affected versions

v5.*
v5.10.233
v5.10.234
v5.10.235
v5.10.236
v5.10.237
v5.10.238
v5.10.239
v5.10.240
v5.10.241
v5.10.242
v5.10.243
v5.10.244
v5.10.245
v5.10.246
v5.10.247
v5.10.248
v5.10.249
v5.10.250
v5.10.251
v5.10.252
v5.10.253
v5.10.254
v5.10.255
v5.10.256
v5.10.257
v5.10.258
v5.10.259
v5.10.260
v5.10.261
v5.10.262
v5.10.263
v5.10.264
v5.10.265
v5.10.266
v5.4.289
v5.4.290
v5.4.291
v5.4.292
v5.4.293
v5.4.294
v5.4.295
v5.4.296
v5.4.297
v5.4.298
v5.4.299
v5.4.300
v5.4.301
v5.4.302

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80792.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.10.267
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.218
Type
ECOSYSTEM
Events
Introduced
5.15.0
Fixed
6.1.185
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.6.154
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.12.106
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.18.47
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
7.1.11
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
7.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-80792.json"