Description

In the Linux kernel, the following vulnerability has been resolved: inet: frags: invalidate queues before flushing them fqdir_pre_exit() flushes the skbs from incomplete queues without changing their completion state. A fragment which found a queue before high_thresh was cleared can then acquire the queue lock and reuse stale reassembly metadata. A queue concurrently killed after fqdir->dead is set can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while still holding its old skbs; skipping it because it is complete leaves those references behind until asynchronous fqdir teardown. For IPv6, stale metadata can make ip6_frag_reasm() use the old nhoffset with a new skb and access memory out of bounds. The resulting heap corruption can be leveraged for local privilege escalation when unprivileged network namespaces are available. Unflushed fragments can also keep conntrack references alive after the conntrack per-net cleanup point. Kill each incomplete queue, then flush every queue still owned by the dying rhashtable. HASH_DEAD identifies that ownership, while complete queues without it are already owned by another destroy path and must be left alone. Releasing a timer reference removed by inet_frag_kill() is deferred to inet_frag_putn(), after the queue lock is dropped. KASAN report: BUG: KASAN: slab-out-of-bounds in ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) Write of size 1 at addr ff110001039c6e00 by task poc/771 Call Trace: ? ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2)) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479 (discriminator 5)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) The buggy address belongs to the object at ff110001039c6b40 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 0 bytes to the right of allocated 704-byte region [ff110001039c6b40, ff110001039c6e00) BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) Read of size 1 at addr ff110001039c6e08 by task poc/771 Call Trace: ? ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1)) ip6_input_finish (net/ipv6/ip6_input.c:534) ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3)) packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) packet_sendmsg (net/packet/af_packet.c:2959 net/packet/af_packet.c:3053 net/packet/af_packet.c:3142) __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880) The buggy address belongs to the object at ff110001039c6b40 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 8 bytes to the right of allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:11.573Z",
  "pubdate": "2026-09-25T11:17:11.573Z",
  "executiveSummary": "This vulnerability involves a Use-After-Free and Out-Of-Bounds (OOB) memory access flaw within the Linux kernel's IPv6 fragment reassembly mechanism.\nThe root cause lies in improper synchronization during the teardown of fragment queues in fqdir_pre_exit(), allowing stale reassembly metadata to persist.\nAn unprivileged attacker with access to network namespaces can exploit this race condition to trigger heap corruption.\nThe primary impact is local privilege escalation, where the corruption of skbuff_small_head structures allows an attacker to manipulate kernel memory, potentially leading to arbitrary code execution.\nExploitation requires the ability to create unprivileged network namespaces and send crafted, fragmented IPv6 packets to trigger the race condition during fragment queue flushing.\nThe flaw affects the interaction between the fragment reassembly state, the rhashtable, and concurrent packet processing.",
  "technicalDetails": "The vulnerability occurs within the Linux kernel networking stack, specifically during the cleanup of IPv6 fragment queues in the fqdir_pre_exit() function. The issue arises when fragment queues are flushed without adequately invalidating their completion state or preventing concurrent access.\nWhen fqdir_pre_exit() is invoked to tear down fragment queues, it flushes skbs from incomplete queues but fails to atomically transition their state. A race condition is established where a fragment, having found a queue prior to the clearing of the high_thresh limit, can successfully acquire the queue lock. Because the reassembly metadata has not been properly cleared or invalidated, the fragment proceeds to reuse stale metadata.\nIf a queue is killed concurrently after the fqdir->dead flag is set, it may enter a state characterized by the flags INET_FRAG_COMPLETE and INET_FRAG_HASH_DEAD while still maintaining references to old skbs. The teardown logic skips these queues because they appear 'complete,' effectively leaving dangling references that remain until asynchronous fqdir teardown occurs.\nFor IPv6, the exploitation involves ip6_frag_reasm() using the stale nhoffset (next header offset) from the corrupted or reused fragment metadata. When processing a new skb, the kernel utilizes this outdated offset, resulting in an OOB memory access. KASAN reports confirm this as slab-out-of-bounds writes and reads within the skbuff_small_head cache (size 704).\nThe attack flow proceeds as follows: 1) The attacker initiates fragmented IPv6 traffic in an environment where fragment queues are being actively managed or torn down. 2) The attacker triggers the race condition by forcing the system to flush queues while new fragments are being processed against existing, stale metadata. 3) The kernel misinterprets the metadata, causing a read/write operation to occur beyond the bounds of the allocated buffer for the skbuff. 4) By manipulating the kernel heap in this manner, an attacker can overwrite adjacent kernel structures, leading to local privilege escalation.\nThe vulnerability is exacerbated by the ability of unprivileged users to create network namespaces, which provides the necessary control over the networking stack to reliably trigger the race condition and observe the side effects of the resulting heap corruption."
}