CVE-2026-89563

Name of the Vulnerable Software and Affected Versions Linux Kernel (affected versions not specified)

Description An issue exists in the ip6 tnl xmit() function where the use of skb realloc headroom() to expand headroom for outer IPv6 and optional encap headers can lead to a use-after-free scenario. The function consumes the original socket buffer (skb) and replaces it with a new one; however, if subsequent operations such as ip6 tnl encap() fail, the function returns an error while the caller still holds a pointer to the original, already consumed skb. Consequently, paths like ip6 tnl start xmit() and IPv6 GRE may attempt to free the original skb again, resulting in a double-free. This is resolved by using skb cow head(), which ensures headroom and writability without replacing the caller-owned skb.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.