CVE-2026-53006
published 2026-06-24CVE-2026-53006: In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is…
PriorityP346critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.39%
30.8th percentile
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in icmpv6_rcv()
Caching saddr and daddr before pskb_pull() is problematic
since skb->head can change.
Remove these temporary variables:
- We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr
when net_dbg_ratelimited() is called in the slow path.
- Avoid potential future misuse after pskb_pull() call.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < 7bff2c8fe5c35ae58bf73104f53db3676e6e5d94 | 7bff2c8fe5c35ae58bf73104f53db3676e6e5d94 |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < aff0f28f5be803de2452ce702631c021fcd9ce8a | aff0f28f5be803de2452ce702631c021fcd9ce8a |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < 38bdbc897c0d83a3e2b925a51b69420f1feba29a | 38bdbc897c0d83a3e2b925a51b69420f1feba29a |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < 0069813e6ca9309eca78022bcb3aeb1e9ef90a12 | 0069813e6ca9309eca78022bcb3aeb1e9ef90a12 |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < 1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7 | 1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7 |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < 7c66b368c6ff453f99cb39d84af93e908e51eef2 | 7c66b368c6ff453f99cb39d84af93e908e51eef2 |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < 085e31a811ef234ef8c3e219c4636dfebfe7e10f | 085e31a811ef234ef8c3e219c4636dfebfe7e10f |
| linux | linux | >= 4b3418fba0fe819197e3359d5ddbef84ba2c59de < f996edd7615e686ada141b7f3395025729ff8ccb | f996edd7615e686ada141b7f3395025729ff8ccb |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 4.4 < 5.10.258 | 5.10.258 |
| linux | linux_kernel | >= 5.11 < 5.15.209 | 5.15.209 |
| linux | linux_kernel | >= 5.16 < 6.1.175 | 6.1.175 |
| linux | linux_kernel | >= 6.13 < 6.18.33 | 6.18.33 |
| linux | linux_kernel | >= 6.19 < 7.0.10 | 7.0.10 |
| linux | linux_kernel | >= 6.2 < 6.6.141 | 6.6.141 |
| linux | linux_kernel | >= 6.7 < 6.12.91 | 6.12.91 |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat7.0HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 7.0.9 ipv6 icmpv6_rcv head use after free (WID-SEC-2026-2077)
vuldb·2026-06-27
CVE-2026-53006 [CRITICAL] Linux Kernel up to 7.0.9 ipv6 icmpv6_rcv head use after free (WID-SEC-2026-2077)
A vulnerability was found in Linux Kernel up to 7.0.9. It has been classified as critical. Affected by this vulnerability is the function icmpv6_rcv of the component ipv6. Performing a manipulation of the argument head results in use after free.
This vulnerability is cataloged as CVE-2026-53006. The attack must originate from the local network. There is no exploit available.
Upgrading the affected component is recommended.
GHSA
In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change.
ghsa_unreviewed·2026-06-24
CVE-2026-53006 In the Linux kernel, the following vulnerability has been resolved: ipv6: fix possible UAF in icmpv6_rcv() Caching saddr and daddr before pskb_pull() is problematic since skb->head can change.
In the Linux kernel, the following vulnerability has been resolved:
ipv6: fix possible UAF in icmpv6_rcv()
Caching saddr and daddr before pskb_pull() is problematic
since skb->head can change.
Remove these temporary variables:
- We only access &ipv6_hdr(skb)->saddr and &ipv6_hdr(skb)->daddr
when net_dbg_ratelimited() is called in the slow path.
- Avoid potential future misuse after pskb_pull() call.
Red Hat
kernel: ipv6: fix possible UAF in icmpv6_rcv()
vendor_redhat·2026-06-24·CVSS 7.0
CVE-2026-53006 [HIGH] CWE-825 kernel: ipv6: fix possible UAF in icmpv6_rcv()
kernel: ipv6: fix possible UAF in icmpv6_rcv()
A flaw was found in the Linux kernel's IPv6 (Internet Protocol version 6) implementation. This vulnerability, a Use-After-Free (UAF) error, occurs due to incorrect caching of network packet addresses before a memory operation. An attacker could potentially exploit this flaw to cause memory corruption, which may lead to a denial of service or, in some scenarios, arbitrary code execution.
Package: kernel (Red Hat Enterprise Linux 10) - Affected
Package: kernel (Red Hat Enterprise Linux 6) - Under investigation
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Aff
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0069813e6ca9309eca78022bcb3aeb1e9ef90a12https://git.kernel.org/stable/c/085e31a811ef234ef8c3e219c4636dfebfe7e10fhttps://git.kernel.org/stable/c/1e1f0f89ee4692a64be3f3707ff8ac1ae57b03e7https://git.kernel.org/stable/c/38bdbc897c0d83a3e2b925a51b69420f1feba29ahttps://git.kernel.org/stable/c/7bff2c8fe5c35ae58bf73104f53db3676e6e5d94https://git.kernel.org/stable/c/7c66b368c6ff453f99cb39d84af93e908e51eef2https://git.kernel.org/stable/c/aff0f28f5be803de2452ce702631c021fcd9ce8ahttps://git.kernel.org/stable/c/f996edd7615e686ada141b7f3395025729ff8ccbhttps://access.redhat.com/security/cve/CVE-2026-53006https://bugzilla.redhat.com/show_bug.cgi?id=2492363https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-53006.json
2026-06-24
Published