In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In… (CVE-2026-64132)
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb_ensure_writable(), which might reallocate the buffer: if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) goto drop; /* Trace pointer may have changed */ trace = (struct ioam6_trace_hdr *)(skb_network_header(skb) + optoff + sizeof(*hdr)); ioam6_fill_trace_data(skb, ns, trace, true); ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev), GFP_ATOMIC, (void *)trace, hdr->opt_len - 2); If the skb is cloned or lacks sufficient linear headroom, skb_ensure_writable() will invoke pskb_expand_head(), which reallocates the skb's data buffer and frees the old one, invalidating pointers to it. While the code recalculates the trace pointer immediately after the call to skb_ensure_writable(), it fails to recalculate the hdr pointer. This patch fixes the above by recalculating the hdr pointer before passing hdr->opt_len to ioam6_event(), so that we avoid any UaF.
AI Analysis
Technical Summary
The vulnerability in the Linux kernel's IPv6 ioam implementation arises because the hdr pointer is initialized to point into the skb's linear data buffer but is not refreshed after skb_ensure_writable() is called. Since skb_ensure_writable() can reallocate the skb buffer and free the old one, the hdr pointer may become invalid, causing a use-after-free condition. The patch fixes this by recalculating the hdr pointer before it is used in ioam6_event(), preventing unsafe memory access.
Potential Impact
The vulnerability could lead to use-after-free memory access within the kernel's IPv6 ioam code, potentially causing kernel crashes or other undefined behavior. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions implementing this code path.
Mitigation Recommendations
A fix has been applied to the Linux kernel to recalculate the hdr pointer after skb_ensure_writable() to prevent use-after-free. Users should update their Linux kernel to a version that includes this patch once available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for the fixed versions and apply them accordingly.
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In… (CVE-2026-64132)
Description
In the Linux kernel, the following vulnerability has been resolved: ipv6: ioam: refresh hdr pointer before ioam6_event() Reported by Sashiko: In ipv6_hop_ioam(), the hdr pointer is initialized to point into the skb's linear data buffer. Later, the code calls skb_ensure_writable(), which might reallocate the buffer: if (skb_ensure_writable(skb, optoff + 2 + hdr->opt_len)) goto drop; /* Trace pointer may have changed */ trace = (struct ioam6_trace_hdr *)(skb_network_header(skb) + optoff + sizeof(*hdr)); ioam6_fill_trace_data(skb, ns, trace, true); ioam6_event(IOAM6_EVENT_TRACE, dev_net(skb->dev), GFP_ATOMIC, (void *)trace, hdr->opt_len - 2); If the skb is cloned or lacks sufficient linear headroom, skb_ensure_writable() will invoke pskb_expand_head(), which reallocates the skb's data buffer and frees the old one, invalidating pointers to it. While the code recalculates the trace pointer immediately after the call to skb_ensure_writable(), it fails to recalculate the hdr pointer. This patch fixes the above by recalculating the hdr pointer before passing hdr->opt_len to ioam6_event(), so that we avoid any UaF.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in the Linux kernel's IPv6 ioam implementation arises because the hdr pointer is initialized to point into the skb's linear data buffer but is not refreshed after skb_ensure_writable() is called. Since skb_ensure_writable() can reallocate the skb buffer and free the old one, the hdr pointer may become invalid, causing a use-after-free condition. The patch fixes this by recalculating the hdr pointer before it is used in ioam6_event(), preventing unsafe memory access.
Potential Impact
The vulnerability could lead to use-after-free memory access within the kernel's IPv6 ioam code, potentially causing kernel crashes or other undefined behavior. No known exploits in the wild have been reported. The impact is limited to affected Linux kernel versions implementing this code path.
Mitigation Recommendations
A fix has been applied to the Linux kernel to recalculate the hdr pointer after skb_ensure_writable() to prevent use-after-free. Users should update their Linux kernel to a version that includes this patch once available. Patch status is not yet confirmed in this data; check the official Linux kernel advisories or vendor updates for the fixed versions and apply them accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-ph8w-wrch-h8v5
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64132"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a82a4a8d598912abda
Added to database: 07/19/2026, 19:38:16 UTC
Last enriched: 07/19/2026, 19:44:32 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 15
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.