Description

In the Linux kernel, the following vulnerability has been resolved: mpls: reload header after pskb_may_pull() mpls_select_multipath() calls mpls_multipath_hash() to choose a nexthop when an MPLS route has multiple nexthops. While walking the MPLS label stack, the hash routine caches hdr for the current label. After finding the bottom-of-stack label, it calls pskb_may_pull() before reading the inner IP header. If an skb is constructed with the inner IP header in nonlinear data and insufficient tailroom in the linear head, pskb_may_pull() calls pskb_expand_head() to replace the skb head and free the old one. This leaves hdr pointing to freed memory. The IPv6 path can invalidate hdr again when it performs a second pull for the larger header. The issue was found through static analysis. A reproducer sending a legal Geneve packet through a bareudp/MPLS multipath setup triggered the same KASAN report in 2 of 2 unpatched runs: BUG: KASAN: slab-use-after-free in mpls_select_multipath Read of size 1 at addr ffff88800ecc6e20 by task ksoftirqd/1/23 Call Trace: mpls_select_multipath mpls_forward __netif_receive_skb_list_core netif_receive_skb_list_internal napi_complete_done gro_cell_poll __napi_poll net_rx_action Freed by task 23: kfree pskb_expand_head __pskb_pull_tail mpls_select_multipath Reload hdr from the current skb head after each successful pull before deriving the inner IPv4 or IPv6 header pointer.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-11T20:19:39.147Z",
  "pubdate": "2026-09-11T20:19:39.147Z",
  "executiveSummary": "This vulnerability is a use-after-free (UAF) flaw within the Linux kernel's MPLS (Multiprotocol Label Switching) implementation. The issue resides in mpls_select_multipath when processing packets that require expansion of the linear skb head.\nThe vulnerability occurs because the pointer to the MPLS header, 'hdr', is cached before a call to pskb_may_pull(). If pskb_may_pull() triggers a buffer reallocation via pskb_expand_head(), the original memory buffer is freed, leaving 'hdr' pointing to a dangling, invalid memory location.\nAn unauthenticated, remote attacker capable of sending specially crafted network traffic—such as Geneve-encapsulated packets processed through bareudp/MPLS multipath routes—can trigger this condition. Successful exploitation results in a kernel panic or potential arbitrary memory read, leading to a denial-of-service (DoS) condition or potential escalation of privilege. The flaw is inherent to the kernel's memory management during packet parsing and affects systems utilizing MPLS forwarding with multipath nexthops.",
  "technicalDetails": "The root cause of this vulnerability is the unsafe caching of a pointer to the skb's data head across an operation that modifies the skb structure. Specifically, in mpls_select_multipath(), the kernel iterates through the MPLS label stack to identify the bottom-of-stack label.\nDuring this process, the 'hdr' variable is assigned the memory address of the current label within the skb linear data region. Following the identification of the bottom-of-stack label, the kernel executes pskb_may_pull() to ensure the inner network header (IPv4/IPv6) is present in the linear data buffer for further processing.\nThe pskb_may_pull() function is designed to handle cases where the required header is stored in non-linear data (fragmented). If the required length exceeds the current linear head's capacity, the kernel calls pskb_expand_head(). This function allocates a new, larger buffer, copies the existing data, and frees the original buffer. Because 'hdr' was assigned prior to this reallocation, it is rendered a dangling pointer.\nSubsequent attempts by the kernel to dereference the 'hdr' pointer—which is required to derive the inner IPv4 or IPv6 header pointer—lead to a use-after-free condition. This is confirmed by KASAN (Kernel Address Sanitizer) reports indicating a read-after-free access in mpls_select_multipath.\nThe attack flow requires the target system to be configured for MPLS multipath forwarding. An attacker sends a crafted packet (e.g., Geneve-encapsulated) that hits the multipath path selection logic. By ensuring the inner headers are positioned such that pskb_may_pull() necessitates an expansion of the skb head, the attacker triggers the UAF. Further complexity exists in the IPv6 path, where multiple pulls can occur, repeatedly invalidating the cached header pointer if not correctly updated.\nExploitation does not require special privileges from the attacker; it only requires the ability to route traffic through an MPLS-enabled kernel interface. Post-exploitation impact ranges from system crashes (kernel oops) to the leaking of sensitive kernel memory values if the freed memory is reallocated and used as a source for subsequent operations."
}