In the Linux kernel, the following vulnerability has been resolved:
ip6mr: Fix skb_under_panic in ip6mr_cache_report()
skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: <TASK> skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20
When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit() ip6mr_cache_report() skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4 And skb_push declared as: void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernel-develUpgrade bpftoolUpgrade kernel-livepatch-5.10.192-182.736Upgrade kernel-debuginfoUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-livepatch-5.15.128-80.144Upgrade kernel-tools-develUpgrade python-perfUpgrade kernel-headersUpgrade kernel-livepatch-4.14.322-244.536Upgrade perfUpgrade kernelUpgrade kernel-toolsUpgrade python-perf-debuginfoUpgrade perf-debuginfo | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-libbpfUpgrade kernel-libbpf-develUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-develUpgrade kernel-debuginfoUpgrade perfUpgrade perf-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-develUpgrade kernel-toolsUpgrade kernel-headersUpgrade python3-perf | Sep 30, 2025 | Sep 17, 2025 |
| Debian | — | Upgrade linux | Sep 19, 2025 | Sep 19, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade kernel-tools-libsUpgrade python3-perfUpgrade bpftoolUpgrade kernelUpgrade kernel-abi-stablelists | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade kernel | Jan 30, 2026 | Sep 17, 2025 |
| Redhat_linux | — | No solution existsUpgrade kernel-rtUpgrade kernel | Nov 14, 2025 | Sep 17, 2025 |
| Ubuntu | — | Upgrade linux-azure-fdeUpgrade linux-realtimeUpgrade linux-gcp-5.15Upgrade linux-xilinx-zynqmpUpgrade linux-azure-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-aws-fipsUpgrade linux-gcp-5.4Upgrade linux-hwe-5.15Upgrade linux-gkeopUpgrade linux-ibmUpgrade linux-riscv-5.15Upgrade linux-hwe-5.4Upgrade linux-azure-5.4Upgrade linux-azure-5.15Upgrade linux-intel-iotg-5.15Upgrade linux-lowlatencyUpgrade linux-iotUpgrade linux-azureUpgrade linux-kvmUpgrade linux-gcp-fipsUpgrade linux-oracleUpgrade linux-oracle-5.15Upgrade linux-nvidiaUpgrade linux-intel-iotgUpgrade linux-fipsUpgrade linux-aws-5.4Upgrade linux-raspiUpgrade linux-gkeUpgrade linux-bluefieldUpgrade linuxUpgrade linux-lowlatency-hwe-5.15Upgrade linux-ibm-5.4Upgrade linux-oracle-5.4Upgrade linux-nvidia-tegraUpgrade linux-awsUpgrade linux-ibm-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-aws-5.15Upgrade linux-raspi-5.4Upgrade linux-gcpUpgrade linux-nvidia-tegra-5.15 | Sep 26, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub