CVE-2026-80792High· 7.0▾ TwilightA flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the `ip6_finish_output2()` function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 38.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 19.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CSAF
0.2%
Last analysed / modified upstream
— → 7
none → high
A flaw was found in the Linux kernel's IPv6 networking stack. A use-after-free vulnerability exists in the ip6_finish_output2() function, where a cached pointer to the IPv6 destination address can become stale after memory reallocation. An attacker could potentially exploit this to leak sensitive kernel data, misdirect network traffic, or cause a system crash (Denial of Service).
kernel: ipv6: fix use-after-free in ip6_finish_output2() — rated Important by Red Hat. Released 2026-09-04, updated 2026-10-26.
Affected:
Fixed:
No fix planned:
Not affected:
For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:76738 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:83707 For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258
The system must be rebooted for this update to take effect.
Red Hat recommends treating all kernel errata as security-relevant. Given the kernel's fundamental role, any bug has a higher chance of impacting system security, even if that impact only becomes clear after a fix is published. Therefore, Red Hat prioritizes delivering fixes that improve our customers' overall security posture.
Because of this proactive approach, a patch may be associa… https://access.redhat.com/errata/RHSA-2026:77218
Workarounds / mitigations:
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63922High· 7.0kernel: ipv6: exthdrs: refresh nh after handling HAO option (CVE-2026-63922)
CVE-2026-63924High· 7.0kernel: ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (CVE-2026-63924)
CVE-2026-74746Critical· 9.8In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nf_flow_table_iterate() only treats original-direction tuple nodes as owning entries
CVE-2026-63984High· 7.0kernel: ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (CVE-2026-63984)
CVE-2026-63920High· 7.0kernel: ipv6: validate extension header length before copying to cmsg (CVE-2026-63920)
CVE-2026-68121High· 7.3kernel: pppoe: reload header pointer after dev_hard_header() (CVE-2026-68121)