Linux Kernel: Possible UAF in icmpv6_rcv (IPv6)
CVE-2026-53006 Published on June 24, 2026
ipv6: fix possible UAF in icmpv6_rcv()
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in icmpv6_rcv()
Caching saddr and daddr before pskb_pull() is problematic
since skb->head can change.
Remove these temporary variables:
- We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr
when net_dbg_ratelimited() is called in the slow path.
- Avoid potential future misuse after pskb_pull() call.
Vulnerability Analysis
CVE-2026-53006 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Dangling pointer Vulnerability?
The program dereferences a pointer that contains a location for memory that was previously valid, but is no longer valid. When a program releases memory, but it maintains a pointer to that memory, then the memory might be re-allocated at a later time. If the original pointer is accessed to read or write data, then this could cause the program to read or modify data that is in use by a different function or process. Depending on how the newly-allocated memory is used, this could lead to a denial of service, information exposure, or code execution.
CVE-2026-53006 has been classified to as a Dangling pointer vulnerability or weakness.
Products Associated with CVE-2026-53006
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-53006 are published in these products:
Affected Versions
Linux:- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below 7bff2c8fe5c35ae58bf73104f53db3676e6e5d94 is affected.
- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below aff0f28f5be803de2452ce702631c021fcd9ce8a is affected.
- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below 38bdbc897c0d83a3e2b925a51b69420f1feba29a is affected.
- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below 0069813e6ca9309eca78022bcb3aeb1e9ef90a12 is affected.
- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below 1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7 is affected.
- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below 7c66b368c6ff453f99cb39d84af93e908e51eef2 is affected.
- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below 085e31a811ef234ef8c3e219c4636dfebfe7e10f is affected.
- Version 4b3418fba0fe819197e3359d5ddbef84ba2c59de and below f996edd7615e686ada141b7f3395025729ff8ccb is affected.
- Version 4.4 is affected.
- Before 4.4 is unaffected.
- Version 5.10.258, <= 5.10.* is unaffected.
- Version 5.15.209, <= 5.15.* is unaffected.
- Version 6.1.175, <= 6.1.* is unaffected.
- Version 6.6.141, <= 6.6.* is unaffected.
- Version 6.12.91, <= 6.12.* is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
- Version 0:6.12.0-211.40.1.el10_2 and below * is unaffected.
- Version 0:4.18.0-553.148.1.rt7.489.el8_10 and below * is unaffected.
- Version 0:4.18.0-553.148.1.el8_10 and below * is unaffected.
- Version 0:4.18.0-477.163.1.el8_8 and below * is unaffected.
- Version 0:4.18.0-477.163.1.el8_8 and below * is unaffected.
- Version 0:5.14.0-687.30.1.el9_8 and below * is unaffected.
- Version V3.1.6 and below * is affected.
- Version V3.1.6 and below * is affected.
- Version V3.1.6 and below * is affected.
- Version V3.1.6 and below * is affected.
- Version V3.1.6 and below * is affected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.