In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below…
Critical CVSS 9.8
Summary
In the Linux kernel, the following vulnerability has been resolved: rpl: Fix use-after-free in rpl_do_srh_inline(). Running lwt_dst_cache_ref_loop.sh in selftest with KASAN triggers the splat below [0]. rpl_do_srh_inline() fetches ipv6_hdr(skb) and accesses it after skb_cow_head(), which is illegal as the header could be freed then. Let's fix it by making oldhdr to a local struct instead of a pointer. [0]: [root@fedora net]# ./lwt_dst_cache_ref_loop.sh ... TEST: rpl (input) [ 57.631529] …
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Affected products
- :
- :
Sources
- NVD DATABASE
Original Links
- https://git.kernel.org/stable/c/034b428aa3583373a5a20b1c5931bb2b3cae1f36 Patch
- https://git.kernel.org/stable/c/06ec83b6c792fde1f710c1de3e836da6e257c4c4 Patch
- https://git.kernel.org/stable/c/62dcd9d6e61c39122d2f251a26829e2e55b0a11d Patch
- https://git.kernel.org/stable/c/8ba6c2362b85089b8972ac5f20b24fc71a4b8ffc Patch
- https://git.kernel.org/stable/c/b640daa2822a39ff76e70200cb2b7b892b896dce Patch
- https://git.kernel.org/stable/c/c09e21dfc08d8afb92d9ea3bee3457adbe3ef297 Patch
- https://git.kernel.org/stable/c/e8101506ab86dd78f823b7028f2036a380f3a12a Patch
- https://lists.debian.org/debian-lts-announce/2025/10/msg00007.html Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2025/10/msg00008.html Third Party Advisory
Timeline
- nvd_ingest NVD