From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51FF53D75B0 for ; Wed, 3 Jun 2026 15:51:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780501872; cv=none; b=OspiaqtuFLEPdvwg85j+xWBZrbdD4JgFbna8Gs2l5F5xH4MdcfJ7ca0ycmqD6tW2M8GkFBDjZRlR3Kxak8JDErUaZVdANA7LimUc1UnOLaR0uDRUVqGGwzhrG60g47Rd90fYrzQsoQUbM2fQf2ORioaH4KAmaETGSZwz7tbl4vM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780501872; c=relaxed/simple; bh=Ns07sAlYa8Npwrn1ta+9v49Zx2a9dwrqoiwwZQsabLs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=U339p8GxcCmcmKslu6PfdZ8D2Oo46M7zIdn5/j/CqYbqWbIFqHcvK7SsJMknjqA1MjlvwVm6zoVp3YsPhprv7cnPR8sC+LO/hJec115xdRLb9IXe6rszxnCJHjokR63oHEkctQVMx/Cxryc4kUr7p3RcNumdoJ90iGyOfilxxKk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Dqa1QeMk; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Dqa1QeMk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 521E51F00893; Wed, 3 Jun 2026 15:51:10 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1780501870; bh=wvpo2MRAog2cC8HYj2hKFSaUxpvs462ChJlZMO7G4Hs=; h=From:To:Cc:Subject:Date:Reply-To; b=Dqa1QeMkL+X4y1q9m57dt6sh2GxL3ebqVk2eL6iUs78gHjTdteTQKuLwAF6HYvXnx omLsHujZEeJ73Irf4RXI0qCpB/xzgLOvean77xZ9w+g7K9lZYJL3B8iJMyw+SoPxyV al2hzpusmPNZPyc6TYdwmVvUk6o8xTu3G1wiQ8+k= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-46260: ipv6: Fix out-of-bound access in fib6_add_rt2node(). Date: Wed, 3 Jun 2026 17:49:49 +0200 Message-ID: <2026060336-CVE-2026-46260-dc10@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=6765; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=8Z4/POCZsC6zWQjuLUCrXCaMOSdU5srTc+UQSDV4Cqc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkKvgJbfNvYE6POz+61KzOtfbl1/teJluffbeNrfzjpi lNi2HrOjlgWBkEmBlkxRZYv23iO7q84pOhlaHsaZg4rE8gQBi5OAZjIFjWGBYtZ5i+6HdjKWv/I 7UyrbvHr3aLJ5xjmmboyGk1PMGF/cGa/2oRr9dIOK048BAA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node(). syzbot reported out-of-bound read in fib6_add_rt2node(). [0] When IPv6 route is created with RTA_NH_ID, struct fib6_info does not have the trailing struct fib6_nh. The cited commit started to check !iter->fib6_nh->fib_nh_gw_family to ensure that rt6_qualify_for_ecmp() will return false for iter. If iter->nh is not NULL, rt6_qualify_for_ecmp() returns false anyway. Let's check iter->nh before reading iter->fib6_nh and avoid OOB read. [0]: BUG: KASAN: slab-out-of-bounds in fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 Read of size 1 at addr ffff8880384ba6de by task syz.0.18/5500 CPU: 0 UID: 0 PID: 5500 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xba/0x230 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142 fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1363 [inline] fib6_add+0x910/0x18c0 net/ipv6/ip6_fib.c:1531 __ip6_ins_rt net/ipv6/route.c:1351 [inline] ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3957 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9316b9aeb9 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd8809b678 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f9316e15fa0 RCX: 00007f9316b9aeb9 RDX: 0000000000000000 RSI: 0000200000004380 RDI: 0000000000000003 RBP: 00007f9316c08c1f R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9316e15fac R14: 00007f9316e15fa0 R15: 00007f9316e15fa0 Allocated by task 5499: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5657 [inline] __kmalloc_noprof+0x40c/0x7e0 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] fib6_info_alloc+0x30/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x142/0x860 net/ipv6/route.c:3820 ip6_route_add+0x49/0x1b0 net/ipv6/route.c:3949 inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660 rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958 netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline] netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894 sock_sendmsg_nosec net/socket.c:727 [inline] __sock_sendmsg net/socket.c:742 [inline] ____sys_sendmsg+0xa68/0xad0 net/socket.c:2592 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2646 __sys_sendmsg net/socket.c:2678 [inline] __do_sys_sendmsg net/socket.c:2683 [inline] __se_sys_sendmsg net/socket.c:2681 [inline] __x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The Linux kernel CVE team has assigned CVE-2026-46260 to this issue. Affected and fixed versions =========================== Issue introduced in 6.6.124 with commit 50b7c7a255858a85c4636a1e990ca04591153dca and fixed in 6.6.128 with commit bcc60ad129ae1837cf809c81bff56ec8bfdb6b11 Issue introduced in 6.12.70 with commit d8143c54ceeba232dc8a13aa0afa14a44b371d93 and fixed in 6.12.75 with commit bf5009a06e03ee9a51052bb59f2228a5e4e66260 Issue introduced in 6.18.10 with commit b8ad2d53f706aeea833d23d45c0758398fede580 and fixed in 6.18.14 with commit 03b5051e02f5a3772eee57493ad697d4b505b0c2 Issue introduced in 6.19 with commit bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25 and fixed in 6.19.4 with commit 500e54615c97bc3c427e52305a6fcd38a0e008a3 Issue introduced in 6.19 with commit bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25 and fixed in 7.0 with commit 8244f959e2c125c849e569f5b23ed49804cce695 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-46260 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv6/ip6_fib.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/bcc60ad129ae1837cf809c81bff56ec8bfdb6b11 https://git.kernel.org/stable/c/bf5009a06e03ee9a51052bb59f2228a5e4e66260 https://git.kernel.org/stable/c/03b5051e02f5a3772eee57493ad697d4b505b0c2 https://git.kernel.org/stable/c/500e54615c97bc3c427e52305a6fcd38a0e008a3 https://git.kernel.org/stable/c/8244f959e2c125c849e569f5b23ed49804cce695