CVE-2026-46260
published 2026-06-03CVE-2026-46260: In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node(). syzbot reported out-of-bound read in…
PriorityP340high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.12%
2.2th percentile
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix out-of-bound access in fib6_add_rt2node().
syzbot reported out-of-bound read in fib6_add_rt2node(). [0]
When IPv6 route is created with RTA_NH_ID, struct fib6_info
does not have the trailing struct fib6_nh.
The cited commit started to check !iter->fib6_nh->fib_nh_gw_family
to ensure that rt6_qualify_for_ecmp() will return false for iter.
If iter->nh is not NULL, rt6_qualify_for_ecmp() returns false anyway.
Let's check iter->nh before reading iter->fib6_nh and avoid OOB read.
[0]:
BUG: KASAN: slab-out-of-bounds in fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142
Read of size 1 at addr ffff8880384ba6de by task syz.0.18/5500
CPU: 0 UID: 0 PID: 5500 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142
fib6_add_rt2node_nh net/ipv6/ip6_fib.c:1363 [inline]
fib6_add+0x910/0x18c0 net/ipv6/ip6_fib.c:1531
__ip6_ins_rt net/ipv6/route.c:1351 [inline]
ip6_route_add+0xde/0x1b0 net/ipv6/route.c:3957
inet6_rtm_newroute+0x268/0x19e0 net/ipv6/route.c:5660
rtnetlink_rcv_msg+0x7d5/0xbe0 net/core/rtnetlink.c:6958
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__
Affected
40 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 50b7c7a255858a85c4636a1e990ca04591153dca < bcc60ad129ae1837cf809c81bff56ec8bfdb6b11 | bcc60ad129ae1837cf809c81bff56ec8bfdb6b11 |
| linux | linux | >= 6.12.70 < 6.12.75 | 6.12.75 |
| linux | linux | >= 6.18.10 < 6.18.14 | 6.18.14 |
| linux | linux | >= 6.6.124 < 6.6.128 | 6.6.128 |
| linux | linux | >= b8ad2d53f706aeea833d23d45c0758398fede580 < 03b5051e02f5a3772eee57493ad697d4b505b0c2 | 03b5051e02f5a3772eee57493ad697d4b505b0c2 |
| linux | linux | >= bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25 < 500e54615c97bc3c427e52305a6fcd38a0e008a3 | 500e54615c97bc3c427e52305a6fcd38a0e008a3 |
| linux | linux | >= bbf4a17ad9ffc4e3d7ec13d73ecd59dea149ed25 < 8244f959e2c125c849e569f5b23ed49804cce695 | 8244f959e2c125c849e569f5b23ed49804cce695 |
| linux | linux | >= d8143c54ceeba232dc8a13aa0afa14a44b371d93 < bf5009a06e03ee9a51052bb59f2228a5e4e66260 | bf5009a06e03ee9a51052bb59f2228a5e4e66260 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 6.12.70 < 6.12.75 | 6.12.75 |
| linux | linux_kernel | >= 6.18.10 < 6.18.14 | 6.18.14 |
| linux | linux_kernel | >= 6.19.1 < 6.19.4 | 6.19.4 |
| linux | linux_kernel | >= 6.6.124 < 6.6.128 | 6.6.128 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-6.8 | — | — |
| ubuntu | linux-aws-fips | — | — |
| ubuntu | linux-azure-fips | — | — |
| ubuntu | linux-fips | — | — |
| ubuntu | linux-gcp | — | — |
| ubuntu | linux-gcp-6.8 | — | — |
| ubuntu | linux-gcp-fips | — | — |
| ubuntu | linux-gke | — | — |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vendor_ubuntu8.8HIGH
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (FIPS) vulnerabilities
vendor_ubuntu·2026-07-10
CVE-2025-71235 Linux kernel (FIPS) vulnerabilities
Title: Linux kernel (FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monito
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-07-09
CVE-2026-45960 Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardwar
Ubuntu
Linux kernel (Raspberry Pi Real-time) vulnerabilities
vendor_ubuntu·2026-07-06
CVE-2026-43314 Linux kernel (Raspberry Pi Real-time) vulnerabilities
Title: Linux kernel (Raspberry Pi Real-time) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-02
CVE-2026-43314 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monitoring dr
Ubuntu
Linux kernel (Low Latency) vulnerabilities
vendor_ubuntu·2026-07-02·CVSS 8.8
CVE-2026-43314 [HIGH] Linux kernel (Low Latency) vulnerabilities
Title: Linux kernel (Low Latency) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500, CVE-2026-45998, CVE-2026-46000)
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP
subsystem in the Linux kernel when handling socket buffer fragments. This
flaw is known as Fragnesia. A local attacker could use this to escalate
privileges, or possibly escape a conta
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-07-02
CVE-2026-43314 Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardwar
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-01
CVE-2026-43226 Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI drivers;
- ATM drivers;
- RNBD block device driver;
- Ublk userspace block driver;
- Bus devices;
- Character device driver;
- TPM device driver;
- Clock framework and drivers;
- Clocksource drivers;
- CPU idle management framework;
- Hardware crypto device drivers;
- DMA engine subsystem;
- EFI core;
- GPIO subsystem;
- GPU drivers;
- HID subsystem;
- Hardware monitoring dr
Red Hat
kernel: ipv6: Fix out-of-bound access in fib6_add_rt2node()
vendor_redhat·2026-06-03·CVSS 5.5
CVE-2026-46260 [MEDIUM] CWE-125 kernel: ipv6: Fix out-of-bound access in fib6_add_rt2node()
kernel: ipv6: Fix out-of-bound access in fib6_add_rt2node()
A flaw was found in the Linux kernel's IPv6 networking subsystem. This vulnerability, an out-of-bound read, occurs during the creation of an IPv6 route with specific parameters. A local attacker could exploit this flaw to cause memory corruption, potentially leading to system instability or a denial of service. This issue impacts the reliability and availability of the affected system.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Out of support scope
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Ente
VulDB
Linux Kernel up to 6.6.127/6.12.74/6.18.13/6.19.3 ipv6 fib6_nh out-of-bounds
vuldb·2026-06-03
CVE-2026-46260 [LOW] Linux Kernel up to 6.6.127/6.12.74/6.18.13/6.19.3 ipv6 fib6_nh out-of-bounds
A vulnerability identified as critical has been detected in Linux Kernel up to 6.6.127/6.12.74/6.18.13/6.19.3. Impacted is an unknown function of the component ipv6. The manipulation of the argument fib6_nh leads to out-of-bounds read.
This vulnerability is listed as CVE-2026-46260. The attack must be carried out from within the local network. There is no available exploit.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node().
ghsa_unreviewed·2026-06-03
CVE-2026-46260 In the Linux kernel, the following vulnerability has been resolved: ipv6: Fix out-of-bound access in fib6_add_rt2node().
In the Linux kernel, the following vulnerability has been resolved:
ipv6: Fix out-of-bound access in fib6_add_rt2node().
syzbot reported out-of-bound read in fib6_add_rt2node(). [0]
When IPv6 route is created with RTA_NH_ID, struct fib6_info
does not have the trailing struct fib6_nh.
The cited commit started to check !iter->fib6_nh->fib_nh_gw_family
to ensure that rt6_qualify_for_ecmp() will return false for iter.
If iter->nh is not NULL, rt6_qualify_for_ecmp() returns false anyway.
Let's check iter->nh before reading iter->fib6_nh and avoid OOB read.
[0]:
BUG: KASAN: slab-out-of-bounds in fib6_add_rt2node+0x349c/0x3500 net/ipv6/ip6_fib.c:1142
Read of size 1 at addr ffff8880384ba6de by task syz.0.18/5500
CPU: 0 UID: 0 PID: 5500 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/03b5051e02f5a3772eee57493ad697d4b505b0c2https://git.kernel.org/stable/c/500e54615c97bc3c427e52305a6fcd38a0e008a3https://git.kernel.org/stable/c/8244f959e2c125c849e569f5b23ed49804cce695https://git.kernel.org/stable/c/bcc60ad129ae1837cf809c81bff56ec8bfdb6b11https://git.kernel.org/stable/c/bf5009a06e03ee9a51052bb59f2228a5e4e66260
2026-06-03
Published