In the Linux kernel, the following vulnerability has been resolved:
ip6mr: Fix skb_under_panic in ip6mr_cache_report()
skbuff: skb_under_panic: text:ffffffff88771f69 len:56 put:-4 head:ffff88805f86a800 data:ffff887f5f86a850 tail:0x88 end:0x2c0 dev:pim6reg ------------[ cut here ]------------ kernel BUG at net/core/skbuff.c:192! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 2 PID: 22968 Comm: kworker/2:11 Not tainted 6.5.0-rc3-00044-g0a8db05b571a #236 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_panic+0x152/0x1d0 Call Trace: <TASK> skb_push+0xc4/0xe0 ip6mr_cache_report+0xd69/0x19b0 reg_vif_xmit+0x406/0x690 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 vlan_dev_hard_start_xmit+0x3ab/0x5c0 dev_hard_start_xmit+0x17e/0x6e0 __dev_queue_xmit+0x2d6a/0x3d20 neigh_connected_output+0x3ed/0x570 ip6_finish_output2+0x5b5/0x1950 ip6_finish_output+0x693/0x11c0 ip6_output+0x24b/0x880 NF_HOOK.constprop.0+0xfd/0x530 ndisc_send_skb+0x9db/0x1400 ndisc_send_rs+0x12a/0x6c0 addrconf_dad_completed+0x3c9/0xea0 addrconf_dad_work+0x849/0x1420 process_one_work+0xa22/0x16e0 worker_thread+0x679/0x10c0 ret_from_fork+0x28/0x60 ret_from_fork_asm+0x11/0x20
When setup a vlan device on dev pim6reg, DAD ns packet may sent on reg_vif_xmit(). reg_vif_xmit() ip6mr_cache_report() skb_push(skb, -skb_network_offset(pkt));//skb_network_offset(pkt) is 4 And skb_push declared as: void *skb_push(struct sk_buff *skb, unsigned int len); skb->data -= len; //0xffff88805f86a84c - 0xfffffffc = 0xffff887f5f86a850 skb->data is set to 0xffff887f5f86a850, which is invalid mem addr, lead to skb_push() fails.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade bpftool-debuginfoUpgrade kernel-debuginfoUpgrade kernel-livepatch-5.10.192-182.736Upgrade kernel-debuginfo-common-x86_64Upgrade bpftoolUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools-debuginfoUpgrade kernel-tools-develUpgrade perfUpgrade python-perfUpgrade kernel-headersUpgrade perf-debuginfoUpgrade python-perf-debuginfoUpgrade kernel-livepatch-4.14.322-244.536Upgrade kernel-toolsUpgrade kernelUpgrade kernel-livepatch-5.15.128-80.144 | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-libbpf-staticUpgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade bpftool-debuginfoUpgrade kernelUpgrade kernel-libbpf-develUpgrade kernel-livepatch-6.1.49-69.116Upgrade kernel-tools-debuginfoUpgrade bpftoolUpgrade perfUpgrade kernel-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-tools-develUpgrade kernel-toolsUpgrade python3-perfUpgrade kernel-headersUpgrade kernel-debuginfo | Sep 30, 2025 | Sep 17, 2025 |
| Debian | — | Upgrade linux | Sep 19, 2025 | Sep 19, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-abi-stablelistsUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-libs | Feb 3, 2026 | Feb 2, 2026 |
| Oracle_linux | — | Upgrade kernel | Jan 30, 2026 | Sep 17, 2025 |
| Redhat_linux | — | Upgrade kernel-rtNo solution existsUpgrade kernel | Nov 14, 2025 | Sep 17, 2025 |
| Ubuntu | — | Upgrade linux-fipsUpgrade linux-azureUpgrade linux-ibmUpgrade linux-gcp-5.15Upgrade linux-aws-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-kvmUpgrade linux-realtimeUpgrade linux-xilinx-zynqmpUpgrade linux-oracle-5.15Upgrade linux-gcp-5.4Upgrade linux-azure-5.4Upgrade linux-intel-iotg-5.15Upgrade linux-riscv-5.15Upgrade linux-oracleUpgrade linux-hwe-5.15Upgrade linux-intel-iotgUpgrade linux-gkeopUpgrade linux-gcp-fipsUpgrade linux-lowlatencyUpgrade linux-nvidiaUpgrade linux-hwe-5.4Upgrade linux-azure-5.15Upgrade linux-iotUpgrade linux-azure-fipsUpgrade linux-gcpUpgrade linux-oracle-5.4Upgrade linux-intel-iot-realtimeUpgrade linux-nvidia-tegra-5.15Upgrade linux-bluefieldUpgrade linux-ibm-5.4Upgrade linux-aws-5.15Upgrade linux-aws-5.4Upgrade linux-gkeUpgrade linux-raspi-5.4Upgrade linux-ibm-5.15Upgrade linux-lowlatency-hwe-5.15Upgrade linux-awsUpgrade linux-nvidia-tegraUpgrade linuxUpgrade linux-raspi | Sep 26, 2025 | Sep 17, 2025 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 15, 2025 | Sep 17, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub