Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: fix fib6 walker UAF on seq stop ipv6_route_iter_active() treats a walker in FWS_U at the table root as already unlinked. fib6_del_route() can move a still-linked walker into that same state when the current leaf is the last route at the root, so ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq private object can then be freed while it remains on net->ipv6.fib6_walkers. A later route deletion walks the dangling list and uses the freed walker. Use the list head as membership state and reinitialize it when unlinking. Keep the existing w->node check so a never-started iterator with a zeroed private object is not treated as linked. The same stop helper is used by /proc/net/ipv6_route and by the BPF ipv6_route iterator. The BPF show path only widens the race.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.8",
  "pubDate": "2026-09-25T11:17:21.410Z",
  "pubdate": "2026-09-25T11:17:21.410Z",
  "executiveSummary": "A Use-After-Free (UAF) vulnerability exists in the Linux kernel IPv6 routing table walker mechanism.\nThe vulnerability occurs due to improper state management of the fib6_walker structure during seq_stop operations, specifically when routes are deleted.\nThis flaw affects the network stack's IPv6 route iteration process, impacting both /proc/net/ipv6_route and BPF-based route iterators.\nAn unprivileged local attacker or a privileged user in a containerized environment could potentially trigger this race condition, leading to kernel memory corruption or a system crash.\nThe primary risk is a Denial of Service (DoS) resulting from kernel panics, though potential for arbitrary code execution exists if the dangling pointer can be manipulated to reference malicious data.\nSuccessful exploitation requires the ability to trigger concurrent route table modifications and iteration cycles.",
  "technicalDetails": "The root cause of the vulnerability lies in the logic within ipv6_route_native_seq_stop() and how it interacts with the fib6_walker state machine. Specifically, ipv6_route_iter_active() incorrectly assumes that any walker residing at the table root in state FWS_U is already unlinked from the global net->ipv6.fib6_walkers list.\nWhen fib6_del_route() is invoked, it can transition a still-linked walker into this FWS_U state if the current leaf being removed is the final route remaining at the tree root. Consequently, ipv6_route_native_seq_stop() prematurely terminates, bypassing the necessary fib6_walker_unlink() call.\nThis behavior leaves the fib6_walker structure linked to the net->ipv6.fib6_walkers list, even though the associated sequence private object is scheduled for deallocation. Once the object is freed, the walker remains as a dangling pointer in the kernel's doubly-linked list.\nSubsequent route deletion operations iterate through the fib6_walkers list. When the traversal reaches the dangling pointer, the kernel attempts to dereference memory that has already been returned to the allocator. This leads to a Use-After-Free scenario, where the kernel accesses freed memory, causing non-deterministic behavior, memory corruption, or immediate kernel panics.\nThe vulnerability is exacerbated by the BPF ipv6_route iterator, which shares the same stopping logic and expands the window of opportunity for the race condition. Because the walker's membership state is not correctly enforced, a never-started iterator might also misinterpret a zeroed private object as a linked entity if not for the w->node check.\nExploitation involves pinning a vulnerable walker into the root of the routing table while simultaneously triggering the deletion of the final route in that root. By repeatedly performing these operations, an attacker increases the probability of hitting the race window where a dangling pointer is followed during a list walk. If the attacker can influence the slab allocator to place controlled data at the address previously occupied by the freed fib6_walker, they could potentially hijack control flow or overwrite adjacent kernel data structures."
}