Answer in brief
CVE-2026-80792 records a Unknown severity vulnerability in ipv6: fix use-after-free in ip6_finish_output2(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=4132c4ad00ddbf3a175ea0d2c775b662a32f4c85 <75e0a544ebe9af663ef53ca21e9e9185c51fb54a || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <c95f01b78266828a57060d754fcbfc92123a98ed || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <d960881b9312e781a3429aabceb223ce6b7c882f || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <087ee0d914aaae929f1660c9ca878e367655ba1a || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <3c770ac4e6f07af7c7b40c474a3efc61ffed7862 || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <3dc98e5fe82d069dd29b124ffbdb679331dfea43 || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <99219c82804f266189388e8bf1cf5135d10d5515 || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <73a187384a8c8b983c7fea046d716b6752a1e7a3 || >=e415ed3a4b8b246ee5e9d109ff5153efcf96b9f2 <d0d48d999b0eee6bb176ef4e39d9be868fa80f7e || 1598154fd28ffa4a55beae1970475fd6776554b6 || >=5.10.233 <5.10.267 || >=5.4.289 <5.5 | 75e0a544ebe9af663ef53ca21e9e9185c51fb54a, c95f01b78266828a57060d754fcbfc92123a98ed, d960881b9312e781a3429aabceb223ce6b7c882f, 087ee0d914aaae929f1660c9ca878e367655ba1a, 3c770ac4e6f07af7c7b40c474a3efc61ffed7862, 3dc98e5fe82d069dd29b124ffbdb679331dfea43, 99219c82804f266189388e8bf1cf5135d10d5515, 73a187384a8c8b983c7fea046d716b6752a1e7a3, d0d48d999b0eee6bb176ef4e39d9be868fa80f7e, 5.10.267, 5.5 |
| Linux/Linuxgeneric | 5.15 | Not reported |
Published upstream
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 4, 2026
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix use-after-free in ip6_finish_output2() ip6_finish_output2() caches a pointer to the IPv6 destination address (daddr) before invoking lwtunnel_xmit(). The LWT-BPF transmit path or other encapsulation operations within lwtunnel_xmit() can reallocate the skb head, freeing the memory that daddr points to. When lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale daddr pointer to compute the nexthop and to look up or create the neighbour entry. This results in a use-after-free read, which can leak sensitive kernel data, pollute the neighbour table with arbitrary values, misdirect traffic, or crash the system. Fix this by re-fetching the IPv6 header and the destination address pointer after lwtunnel_xmit() returns LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop computation and neighbour lookup operate on valid memory.
Quoted source text, attributed separately from HOL analysis.