High 7.8Published May 28, 2026

CVE-2026-46120ip6_gre: Use cached t->net in ip6erspan_changelink().

Updated under an hour ago (Oct 28, 2026, 2:30 PM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ip6_gre: Use cached t->net in ip6erspan_changelink(). After commit 5e72ce3e3980 ("net: ipv6: Use link netns in newlink() of rtnl_link_ops"), ip6erspan_newlink() correctly resolves the per-netns ip6gre hash via link_net. ip6erspan_changelink() was not converted in that series and still uses dev_net(dev), which diverges from the device's creation netns after IFLA_NET_NS_FD migration. This re-inserts the tunnel into the wrong per-netns hash. The original netns keeps a stale entry. When that netns is later destroyed, ip6gre_exit_rtnl_net() walks the stale entry, producing a slab-use-after-free reported by KASAN, followed by a kernel BUG at net/core/dev.c (LIST_POISON1) in unregister_netdevice_many_notify(). Reachable from an unprivileged user namespace (unshare --user --map-root-user --net). ip6gre_changelink() earlier in the same file already uses the cached t->net; only ip6erspan_changelink() has the wrong shape.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-416
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Undergoing Analysis
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 2d665034f239412927b1e71329f20f001c92da09 before 7bd0f2b162b426b343a114e1b329f0d8d14fdc6e; 2d665034f239412927b1e71329f20f001c92da09 builds before 01b71ff2857d3598337de11e7840a8e3ff21553c; 2d665034f239412927b1e71329f20f001c92da09 builds before 0fcf6731706f73494245a9c0d64f93bebf95bb51; from 2d665034f239412927b1e71329f20f001c92da09 before eca62bb0569de4d43a4dac06a2092a9d4ca1d702; from 2d665034f239412927b1e71329f20f001c92da09 before 311fdd26eb4443d43b909cc67a10f3a5fd1b21b2; from 2d665034f239412927b1e71329f20f001c92da09 before e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82; from 2d665034f239412927b1e71329f20f001c92da09 before cf7fc624329e76c6394653d12353e1d033adea91; 2d665034f239412927b1e71329f20f001c92da09 builds before 1d324c2f43f70c965f25c58cc3611c779adbe47e; and 2 more ranges	CNA record
Siemens SIMATIC S7-1500 TM MFP - GNU/Linux subsystem siemens:simatic_s7_1500_tm_mfp_gnu_linux_subsystem (from the name)	all versions	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.16.12 before 4.17; from 4.17.1 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.140; from 6.7 before 6.12.88; from 6.13 before 6.18.30; from 6.19 before 7.0.7; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/7bd0f2b162b426b343a114e1b329f0d8d14fdc6e	patch
https://git.kernel.org/stable/c/01b71ff2857d3598337de11e7840a8e3ff21553c	patch
https://git.kernel.org/stable/c/0fcf6731706f73494245a9c0d64f93bebf95bb51	patch
https://git.kernel.org/stable/c/eca62bb0569de4d43a4dac06a2092a9d4ca1d702	patch
https://git.kernel.org/stable/c/311fdd26eb4443d43b909cc67a10f3a5fd1b21b2	patch
https://git.kernel.org/stable/c/e70cfb40c3a99b232cd42c6a6a10f0d8e039dc82	patch
https://git.kernel.org/stable/c/cf7fc624329e76c6394653d12353e1d033adea91	patch
https://git.kernel.org/stable/c/1d324c2f43f70c965f25c58cc3611c779adbe47e	patch
https://cert-portal.siemens.com/productcert/html/ssa-784472.html

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.