Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: addrconf: bail out of dad_failure when state is no longer POSTDAD addrconf_dad_failure() transitions ifp->state from DAD to POSTDAD via addrconf_dad_end(), which drops ifp->lock on return. The lock is re-acquired after net_info_ratelimited(). A concurrent ipv6_del_addr() can take the lock in that window, set ifp->state to DEAD and run list_del_rcu(&ifp->if_list). addrconf_dad_failure() then overwrites DEAD with ERRDAD at errdad: and schedules a new dad_work. The work calls ipv6_del_addr() again, hitting the already-poisoned list entry: general protection fault: 0000 [#1] SMP NOPTI CPU: 4 PID: 217 Comm: kworker/4:1 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:ipv6_del_addr+0xe9/0x280 RAX: dead000000000122 Call Trace: addrconf_dad_stop+0x113/0x140 addrconf_dad_work+0x28c/0x430 process_one_work+0x1eb/0x3b0 worker_thread+0x4d/0x400 kthread+0x104/0x140 ret_from_fork+0x35/0x40 Fold the addrconf_dad_end() logic into addrconf_dad_failure() under a single ifp->lock critical section. The STABLE_PRIVACY branch temporarily drops ifp->lock around address regeneration, so at lock_errdad: verify the state is still POSTDAD before transitioning to ERRDAD; bail out otherwise to avoid overwriting a state set by another path while the lock was released.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-15T06:22:41.790Z",
  "pubdate": "2026-08-15T06:22:41.790Z",
  "executiveSummary": "A race condition vulnerability exists in the Linux kernel IPv6 address configuration component (addrconf). The flaw specifically occurs during Duplicate Address Detection (DAD) failure handling within the addrconf_dad_failure function.\nThe vulnerability allows a local attacker or concurrent network event to trigger a Use-After-Free or memory corruption condition by exploiting a window where object locks are dropped, leading to a general protection fault and potential kernel denial of service.\nThe affected product is the Linux kernel, specifically impacting the networking subsystem handling IPv6 address configuration and DAD states.\nThe risk implication is system instability and potential Denial of Service (DoS) via kernel crashes triggered by general protection faults when interacting with poisoned list entries.\nAttacker capabilities require local execution context or the ability to trigger concurrent IPv6 address deletion events while DAD failure routines are actively executing.\nExploitation requirements include triggering specific race conditions during IPv6 address lifecycle state transitions involving POSTDAD, DEAD, and ERRDAD states.",
  "technicalDetails": "The root cause of the vulnerability is a race condition arising from lock management in addrconf_dad_failure() within net/ipv6/addrconf.c. During the handling of a DAD failure, addrconf_dad_failure() transitions the interface address structure (inet6_ifaddr or ifp->state) from DAD to POSTDAD using addrconf_dad_end(), which temporarily drops the ifp->lock.\nThe lock is subsequently re-acquired after executing net_info_ratelimited(). During this unlocked window, a concurrent execution path such as ipv6_del_addr() can acquire the lock, transition ifp->state to DEAD, and remove the entry from the linked list via list_del_rcu(&ifp->if_list).\nUpon re-acquiring the lock, addrconf_dad_failure() unconditionally overwrites the DEAD state with ERRDAD at the errdad label and schedules a new work queue item via dad_work. When the work queue executes addrconf_dad_stop() and subsequently calls ipv6_del_addr() again, it attempts to manipulate the already-poisoned list entry.\nThis invalid memory reference results in a general protection fault within ipv6_del_addr()+0xe9/0x280, referenced by RIP pointing to the faulting instruction, crashing the kernel worker thread or triggering a kernel panic (Denial of Service).\nThe vulnerable component is the IPv6 address configuration module in the Linux kernel, specifically the DAD failure and state transition logic involving ifp->lock critical sections.\nAuthentication and privilege requirements depend on the local system interface manipulation capabilities, typically requiring administrative privileges or the ability to configure network interfaces locally to trigger rapid address addition and deletion cycles.\nThe attack flow proceeds as follows: 1) DAD failure is initiated for an IPv6 address, dropping ifp->lock during addrconf_dad_end(). 2) A concurrent ipv6_del_addr() executes, transitions the state to DEAD, and unlinks the structure. 3) The original execution path resumes, overwrites the state with ERRDAD without validating the intermediate state change, and schedules dad_work. 4) The deferred work routine invokes ipv6_del_addr() on the already unlinked structure, causing a general protection fault and kernel crash."
}