CVE-2026-23010 — Use After Free in Linux

CWE-416 — Use After FreeCWE-825 — Expired Pointer Dereference7 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 99.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
LinuxLinux KernelDebian Linux+1 more
Timeline
PublishedJan 25

Description

In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del(). syzbot reported use-after-free of inet6_ifaddr in inet6_addr_del(). [0] The cited commit accidentally moved ipv6_del_addr() for mngtmpaddr before reading its ifp->flags for temporary addresses in inet6_addr_del(). Let's move ipv6_del_addr() down to fix the UAF. [0]: BUG: KASAN: slab-use-after-free in inet6_addr_del.constprop.0+0x67a/0x6b0 net/ipv6/addrconf.c:3117 Read of size 4 …

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶Linuxlinux/linux_kernel6.2.0 — 6.6.122+3
▶NVDlinux/linux_kernel6.1.120 — 6.1.162+6
▶Debianlinux/linux_kernel< 6.1.162-1+2
▶CVEListV5linux/linuxca97dd10424860a3806ad3a9e26b9dce2901ee0c — 6e89d60b4f03014f7d412ce64b17a840840d490e+6
▶debiandebian/linux< linux 6.1.162-1 (bookworm)

Patches

Patch: git.kernel.org ↗Patch: git.kernel.org ↗Patch: git.kernel.org ↗

🔴Vulnerability Details

3
OSV
CVE-2026-23010: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del()↗2026-01-25
▶
GHSA
GHSA-3c7w-pf2p-jwm8: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix use-after-free in inet6_addr_del()↗2026-01-25
▶
OSV
ipv6: Fix use-after-free in inet6_addr_del().↗2026-01-25
▶

📋Vendor Advisories

2
Red Hat
kernel: Linux kernel: Use-after-free in IPv6 address deletion may lead to a denial of service↗2026-01-25
▶
Debian
CVE-2026-23010: linux - In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix u...↗2026
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-23010 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-23010 — Use After Free in Linux | cvebase