Re: [PATCH net 1/1] ipv6: fix use-after-free in ip6_finish_output2()

[Ido Schimmel <idosch@nvidia.com>]

On Wed, Aug 12, 2026 at 08:54:38PM +0800, Ren Wei wrote:
> From: Luxiao Xu <rakukuip@gmail.com>
> 
> ip6_finish_output2() caches a pointer to the IPv6 destination
> address (daddr) before invoking lwtunnel_xmit().  The LWT-BPF
> transmit path or other encapsulation operations within
> lwtunnel_xmit() can reallocate the skb head, freeing the memory
> that daddr points to.  When lwtunnel_xmit() returns
> LWTUNNEL_XMIT_CONTINUE, the function continues to use the stale
> daddr pointer to compute the nexthop and to look up or create the
> neighbour entry.  This results in a use-after-free read, which can
> leak sensitive kernel data, pollute the neighbour table with
> arbitrary values, misdirect traffic, or crash the system.
> 
> Fix this by re-fetching the IPv6 header and the destination
> address pointer after lwtunnel_xmit() returns
> LWTUNNEL_XMIT_CONTINUE, ensuring that the subsequent nexthop
> computation and neighbour lookup operate on valid memory.
> 
> Fixes: e415ed3a4b8b ("ipv6: use skb_expand_head in ip6_finish_output2")
> Cc: stable@vger.kernel.org
> Reported-by: Vega <vega@nebusec.ai>
> Assisted-by: Codex:gpt-5.4
> Signed-off-by: Luxiao Xu <rakukuip@gmail.com>
> Signed-off-by: Ren Wei <weir@nebusec.ai>

Reviewed-by: Ido Schimmel <idosch@nvidia.com>