Answer in brief
CVE-2026-68127 records a Unknown severity vulnerability in ila: reload IPv6 header after pskb_may_pull in checksum adjust. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=33f11d16142b06588eedfc1dd8cf93790979a712 <896a9512d0d83c2a4b357e5585b7b62a8e3f95c1 || >=33f11d16142b06588eedfc1dd8cf93790979a712 <7097a0280b178237265681be66d1bef11d15894b || >=33f11d16142b06588eedfc1dd8cf93790979a712 <472aba2603ca74c4f7722cb0c0296942b0776b8d || >=33f11d16142b06588eedfc1dd8cf93790979a712 <c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc || >=33f11d16142b06588eedfc1dd8cf93790979a712 <92d3817649df2b0b6a008a686c8275c88d7ef594 | 896a9512d0d83c2a4b357e5585b7b62a8e3f95c1, 7097a0280b178237265681be66d1bef11d15894b, 472aba2603ca74c4f7722cb0c0296942b0776b8d, c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc, 92d3817649df2b0b6a008a686c8275c88d7ef594 |
| Linux/Linuxgeneric | 4.5 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer. Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists. Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-68127 records a Unknown severity vulnerability in ila: reload IPv6 header after pskb_may_pull in checksum adjust. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=33f11d16142b06588eedfc1dd8cf93790979a712 <896a9512d0d83c2a4b357e5585b7b62a8e3f95c1 || >=33f11d16142b06588eedfc1dd8cf93790979a712 <7097a0280b178237265681be66d1bef11d15894b || >=33f11d16142b06588eedfc1dd8cf93790979a712 <472aba2603ca74c4f7722cb0c0296942b0776b8d || >=33f11d16142b06588eedfc1dd8cf93790979a712 <c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc || >=33f11d16142b06588eedfc1dd8cf93790979a712 <92d3817649df2b0b6a008a686c8275c88d7ef594 | 896a9512d0d83c2a4b357e5585b7b62a8e3f95c1, 7097a0280b178237265681be66d1bef11d15894b, 472aba2603ca74c4f7722cb0c0296942b0776b8d, c6a13ae00dab3a1a8c7cf2f843f0fc9e8d4b0ccc, 92d3817649df2b0b6a008a686c8275c88d7ef594 |
| Linux/Linuxgeneric | 4.5 | Not reported |
Published upstream
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 10, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 10, 2026
In the Linux kernel, the following vulnerability has been resolved: ila: reload IPv6 header after pskb_may_pull in checksum adjust ila_csum_adjust_transport() caches ip6h = ipv6_hdr(skb) before calling pskb_may_pull(). On a non-linear skb whose transport header sits in a page fragment, pskb_may_pull() can call __pskb_pull_tail() / pskb_expand_head() and free the old skb head, leaving ip6h dangling; the following get_csum_diff(ip6h, p) then reads freed memory. ila_update_ipv6_locator() uses ip6h (and the iaddr derived from it) again after the csum-adjust call and additionally writes the new locator through that pointer. Impact: a remote IPv6 packet routed through a configured ILA csum-adjust-transport route or receive-side mapping triggers a slab-use-after-free in ila_update_ipv6_locator() (KASAN). The route or mapping requires CAP_NET_ADMIN to configure, but trigger packets are unauthenticated once it exists. Reload ip6h after each pskb_may_pull() in ila_csum_adjust_transport() before the csum-diff read. In ila_update_ipv6_locator() only the ILA_CSUM_ADJUST_TRANSPORT case pulls the skb, so reload ip6h and iaddr in that case alone before the destination-address write; the neutral-map modes never pull and keep their cached pointers.
Quoted source text, attributed separately from HOL analysis.