CVE-2026-72429

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A type confusion issue exists in the IPv6 IOAM (In-situ Operations, Administration, and Maintenance) implementation. The system uses a dummy dst entry (null dst) within the ioam6 lwt structure to indicate that a destination should remain unchanged. When this dst entry is passed to dst cache set ip6(), the execution path eventually calls the rt6 get cookie() function, which incorrectly treats the dst entry as part of a struct rt6 info. This invalid cast causes rt6 get cookie() to read fields from the wrong object. Specifically, if the rt->sernum field (which aliases ioam6 lwt::cache::reset ts) is zero, it can lead to an invalid pointer access when attempting to access per-cpu values.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.