CVE-2026-68127

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A slab-use-after-free issue exists in the Linux kernel when processing remote IPv6 packets routed through a configured ILA csum-adjust-transport route or receive-side mapping. The function ila csum adjust transport() caches the IPv6 header ip6h before calling pskb may pull(). In cases of non-linear skbs where the transport header is in a page fragment, pskb may pull() may trigger pskb pull tail() or pskb expand head(), which frees the old skb head and leaves ip6h as a dangling pointer. Subsequently, get csum diff(ip6h, p) reads this freed memory. Furthermore, ila update ipv6 locator() uses the dangling ip6h and its derived iaddr to write a new locator. While configuring the route or mapping requires CAP NET ADMIN privileges, the trigger packets are unauthenticated.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.