In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix an uninit variable access bug in __ip6_make_skb()
Syzbot reported a bug as following:
===================================================== BUG: KMSAN: uninit-value in arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] BUG: KMSAN: uninit-value in arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] BUG: KMSAN: uninit-value in atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] BUG: KMSAN: uninit-value in __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 arch_atomic64_inc arch/x86/include/asm/atomic64_64.h:88 [inline] arch_atomic_long_inc include/linux/atomic/atomic-long.h:161 [inline] atomic_long_inc include/linux/atomic/atomic-instrumented.h:1429 [inline] __ip6_make_skb+0x2f37/0x30f0 net/ipv6/ip6_output.c:1956 ip6_finish_skb include/net/ipv6.h:1122 [inline] ip6_push_pending_frames+0x10e/0x550 net/ipv6/ip6_output.c:1987 rawv6_push_pending_frames+0xb12/0xb90 net/ipv6/raw.c:579 rawv6_sendmsg+0x297e/0x2e60 net/ipv6/raw.c:922 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Uninit was created at: slab_post_alloc_hook mm/slab.h:766 [inline] slab_alloc_node mm/slub.c:3452 [inline] __kmem_cache_alloc_node+0x71f/0xce0 mm/slub.c:3491 __do_kmalloc_node mm/slab_common.c:967 [inline] __kmalloc_node_track_caller+0x114/0x3b0 mm/slab_common.c:988 kmalloc_reserve net/core/skbuff.c:492 [inline] __alloc_skb+0x3af/0x8f0 net/core/skbuff.c:565 alloc_skb include/linux/skbuff.h:1270 [inline] __ip6_append_data+0x51c1/0x6bb0 net/ipv6/ip6_output.c:1684 ip6_append_data+0x411/0x580 net/ipv6/ip6_output.c:1854 rawv6_sendmsg+0x2882/0x2e60 net/ipv6/raw.c:915 inet_sendmsg+0x101/0x180 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg net/socket.c:734 [inline] ____sys_sendmsg+0xa8e/0xe70 net/socket.c:2476 ___sys_sendmsg+0x2a1/0x3f0 net/socket.c:2530 __sys_sendmsg net/socket.c:2559 [inline] __do_sys_sendmsg net/socket.c:2568 [inline] __se_sys_sendmsg net/socket.c:2566 [inline] __x64_sys_sendmsg+0x367/0x540 net/socket.c:2566 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd
It is because icmp6hdr does not in skb linear region under the scenario of SOCK_RAW socket. Access icmp6_hdr(skb)->icmp6_type directly will trigger the uninit variable access bug.
Use a local variable icmp6_type to carry the correct value in different scenarios.
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade python-perfUpgrade kernel-tools-debuginfoUpgrade bpftool-debuginfoUpgrade python-perf-debuginfoUpgrade kernelUpgrade kernel-livepatch-5.10.178-162.673Upgrade kernel-debuginfoUpgrade bpftoolUpgrade kernel-livepatch-4.14.313-235.533Upgrade kernel-debuginfo-common-x86_64Upgrade kernel-tools-develUpgrade perfUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-headersUpgrade kernel-livepatch-5.15.108-65.141Upgrade kernel-debuginfo-common-aarch64Upgrade kernel-tools | May 20, 2026 | May 20, 2026 |
| Amazon_linux_2023 | — | Upgrade bpftool-debuginfoUpgrade perf-debuginfoUpgrade kernel-headersUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-toolsUpgrade kernel-livepatch-6.1.25-37.47Upgrade perfUpgrade kernelUpgrade python3-perfUpgrade kernel-tools-debuginfoUpgrade kernel-debuginfo-common-aarch64Upgrade kernel-libbpf-develUpgrade kernel-tools-develUpgrade kernel-debuginfoUpgrade kernel-libbpfUpgrade python3-perf-debuginfoUpgrade bpftoolUpgrade kernel-develUpgrade kernel-libbpf-static | Feb 20, 2026 | Dec 30, 2025 |
| Debian | — | Upgrade linux | Dec 31, 2025 | Dec 31, 2025 |
| Huawei Euleros 2_0_sp13 | — | Upgrade kernel-toolsUpgrade python3-perfUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade bpftoolUpgrade kernel-tools-libs | Mar 10, 2026 | Mar 10, 2026 |
| Redhat_linux | — | No solution exists | Jul 17, 2026 | Dec 30, 2025 |
| Ubuntu | — | Upgrade linux-gcp-5.15Upgrade linux-gcp-fipsUpgrade linux-nvidia-tegra-igxUpgrade linux-gcp-5.4Upgrade linux-aws-fipsUpgrade linux-azureUpgrade linux-hwe-5.15Upgrade linux-nvidiaUpgrade linux-lowlatencyUpgrade linux-azure-fipsUpgrade linux-ibmUpgrade linux-intel-iotg-5.15Upgrade linux-gkeUpgrade linux-azure-5.4Upgrade linux-riscv-5.15Upgrade linux-aws-5.4Upgrade linux-gkeopUpgrade linux-oracleUpgrade linux-xilinx-zynqmpUpgrade linux-intel-iotgUpgrade linux-kvmUpgrade linux-fipsUpgrade linux-hwe-5.4Upgrade linux-oracle-5.15Upgrade linux-azure-5.15Upgrade linux-intel-iot-realtimeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-nvidia-tegra-5.15Upgrade linux-ibm-5.4Upgrade linux-raspi-5.4Upgrade linux-bluefieldUpgrade linux-realtimeUpgrade linuxUpgrade linux-ibm-5.15Upgrade linux-gcpUpgrade linux-nvidia-tegraUpgrade linux-iotUpgrade linux-oracle-5.4Upgrade linux-aws-5.15Upgrade linux-awsUpgrade linux-raspi | Jan 6, 2026 | Jan 2, 2026 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | May 27, 2026 | Dec 30, 2025 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub